CVE-2026-78379 - Consent bypass in Strands Agents Tools python_repl tool

CVE-2026-78379 - Consent bypass in Strands Agents Tools python_repl tool

Bulletin ID: 2026-089-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 08/25/2026 12:00 PM PDT

Strands Agents is an open-source Python SDK for building and running AI agents. The strands-agents-tools package provides pre-built tools for use with the SDK, including the python_repl tool, which executes Python code on the agent's host, and the batch tool, which invokes several other tools in a single call. Before executing code, python_repl prompts the operator for approval. We identified CVE-2026-78379, a consent bypass in the python_repl tool. Improper neutralization of input used for LLM prompting in the python_repl tool in Amazon Strands Agents Tools before 0.8.5 might allow remote actors to execute arbitrary Python code on the agent's host by bypassing the human consent gate, via a crafted prompt that forwards non_interactive_mode as a keyword argument through the batch tool.

This issue has been addressed in strands-agents-tools version 0.8.5. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. In version 0.8.5, python_repl reads non_interactive_mode only from the STRANDS_NON_INTERACTIVE environment variable, so the flag is set by the operator and can no longer be supplied by a caller.

Until you can upgrade, remove either batch or python_repl from the tool list you pass to the agent, since the bypass requires both to be registered on the same agent. Do not make python_repl available to an agent that processes untrusted content, and run any agent that uses python_repl in an isolated, least-privilege environment so that executed code is contained.