External risk intelligence

Strands Agents Tools Prompt Injection Allows Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-78379

The vulnerability exists in a Python library used for building agentic tools. While such tools may be integrated into internet-facing applications or APIs, they are often used in internal automation pipelines, backend processes, or private agent deployments, meaning public internet reachability is context-dependent rather than a default or inherent characteristic of the library itself.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the python_repl tool within Amazon Strands Agents Tools could allow remote actors to execute arbitrary Python code by bypassing security checks through crafted prompts. This bypass is possible when the `non_interactive_mode` is forwarded as a keyword argument via the batch tool.

Malicious prompts can bypass consent to run code.
This affects tools that use the python_repl feature.
Confirm relevance and exposure for affected internal tools.

Attack Path

How an attacker could exploit the issue

An attacker could send a specially crafted prompt to an agent utilizing the vulnerable tool. This prompt would need to be designed to bypass the agent's usual safety checks, potentially tricking it into executing arbitrary Python code on the host system.

Attacker sends a crafted prompt.
Vulnerable Python tool processes the prompt.
Arbitrary code execution on the agent's host.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, remote actors could execute arbitrary Python code on the agent's host by bypassing the human consent gate, via a crafted prompt.

Agent host system data may be affected.
Prompt injection could lead to code execution.
Unauthorized code execution on agent host.

Operational Fix

Recommended remediation, mitigation, and detection steps

The python_repl tool within Amazon Strands Agents Tools is susceptible to a critical vulnerability, allowing remote attackers to execute arbitrary Python code. This exploit bypasses consent gates through crafted prompts. Ownership for remediation likely falls to teams managing the specific agent applications or workflows utilizing this tool. The immediate first step is to inventory where the affected tool is deployed, confirm its exposure and criticality, identify the accountable owner, and then meticulously plan remediation during a maintenance window.

Application owners responsible for agent tools.
Confirm agent tool deployment and reachability.
Plan upgrade during next maintenance window.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Amazon Strands Agents Tools?

It is a specialized software library designed for building and managing agentic workflows. Developers use its tools, such as the python_repl component, to enable autonomous agents to execute Python code, automate complex tasks, and process data within backend pipelines or private agent deployments.

How does CVE-2026-78379 lead to code execution?

This vulnerability is a form of improper input neutralization. It occurs when a crafted prompt manipulates the python_repl tool, tricking the agent into bypassing built-in human consent gates. This allows the unintended execution of arbitrary Python code on the host system where the agent is running.

Do I need to be concerned about every prompt?

No. The flaw is specifically triggered when a crafted prompt forwards the 'non_interactive_mode' keyword argument through the batch tool. Standard agent interactions that do not utilize this specific bypass path do not trigger this code execution vulnerability.

Is my system at risk according to Halo Surface Signal?

Risk depends on how your agent is deployed. While Halo Surface Signal labels this as external, the library is often used in internal automation or backend processes. If your agent is integrated into an internet-facing application, the risk of remote access is higher than for isolated internal workflows.

Why should I upgrade to version 0.8.5?

Upgrading to version 0.8.5 is the only way to remediate this vulnerability. First, inventory all internal workflows or applications utilizing Amazon Strands Agents Tools to confirm if they are running a vulnerable version, then plan an upgrade to version 0.8.5 or later.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.