Intelligence
Join the waitlist
AEV-2026-0019

Strands Agents Tools python_repl consent gate reachable through the batch tool (CVE-2026-78379)

AWS Strands Agents Tools' python_repl tool kept its consent gate switch, non_interactive_mode, out of its own model facing schema, but a crafted prompt could still reach it by forwarding the value as a keyword argument through the batch tool, which passes a caller's arguments to a named tool unfiltered. The result was arbitrary Python code execution on the agent host with no consent step firing. Disclosed by AWS, patched in 0.8.5, with no evidence of exploitation.

AESS 8.1 highConfirmedStatus: resolvedEvent: 25 August 2026Approval ControlsExecution Authority

Affected

Organisation
AWS
Product
Strands Agents Tools
Component
python_repl tool consent gate (non_interactive_mode), reachable via the batch tool
Versions
Versions before 0.8.5; fixed in 0.8.5
Configurations
Agent exposed to untrusted content that can influence tool parameters; Both the batch tool and the python_repl tool available to the same agent

Execution authority facts

Fields the evidence does not establish are shown as unknown rather than guessed.

Intended task
An agent running Python code through the python_repl tool
Agent
An agent built on the Strands Agents SDK
Delegating actor
The operator running the agent
Action
Invoked the batch tool with non_interactive_mode forwarded as a keyword argument into a nested python_repl call, so the consent gate did not fire, then ran Python code
Target resource
The host the agent process runs on
Environment
Wherever the agent process executes
Credentials used
unknown
Privileges available
The privileges of the agent process
Authority presented
A batch tool call whose forwarded arguments reached a second tool's own approval switch, which the second tool's own schema never exposed directly
Authority required
Operator consent to run the code
Applicable policy
The human consent gate on the python_repl tool
Approval mechanism
A consent gate the operator was meant to satisfy
Required approver
The operator
Independent approval
no
Action binding
The gate's enabling condition was reachable through a composing tool's unfiltered argument forwarding, not through python_repl's own schema
Sequence context
A crafted prompt invoked the batch tool, which forwarded non_interactive_mode into a nested python_repl call without the batch tool validating or filtering that argument

Impact

Consequence
Arbitrary Python code run with the agent process's privileges
Reach
The host the agent runs on
Reversibility
unknown
Detectability
Silent: the consent gate did not fire
Propagation
unknown
Recovery
Fixed by restricting the parameter to the STRANDS_NON_INTERACTIVE environment variable, the only source either tool now reads it from

Evidence

Primary sources

Supporting sources

Reproduction status
Confirmed and patched by AWS; CVSS 3.1 base 8.1 in the GitHub advisory
Evidence state
Confirmed

Known unknowns

  • Whether any deployment was affected before the patch.

Limitations

  • No evidence in AWS's advisories, GitHub's advisories or public reporting that it was exploited against a real deployment.
  • This is the fifth vulnerability in the same package to expose an authority defining parameter in a model reachable path; the other four are recorded on AEV-2026-0003 and on the source record's own body rather than folded in here.
  • The batch tool's own argument forwarding was not changed by this fix and still passes a caller's arguments to a named tool unfiltered; no field currently reachable through it is known to still function as an authority defining parameter at any tool this record has reviewed.

Claim provenance