What happened
AWS disclosed (security bulletin 2026-072-AWS, published 08/03/2026) a prompt injection vulnerability in the shell tool bundled with Amazon's open-source Strands Agents SDK. The non_interactive parameter, exposed in the tool's schema and therefore LLM-controllable, could be set by a crafted prompt to skip the mandatory human consent dialog before shell command execution, giving an attacker who can inject text into the agent's context a path to full OS command execution on the agent host.
Why it matters
Strands Agents is AWS's own agent SDK, used in production for tools like Amazon Q Developer, AWS Glue, and other agentic workflows. A shell-execution bypass of the human-approval gate is a textbook agent-execution attack class (indirect prompt injection -> tool misuse -> RCE) with CVSS 8.8 and a well-known, widely deployed target.
Attack vector
A crafted prompt (including indirect prompt injection via untrusted content the agent reads) sets the shell tool's non_interactive parameter to true, bypassing the human-in-the-loop consent gate designed to approve OS command execution. This allows a remote actor to make the agent execute arbitrary operating system commands on its host with no human approval step.
Affected systems
Amazon Strands Agents Tools (strands-agents-tools) < 0.8.0
Mitigation
Upgrade to strands-agents-tools 0.8.0 or later. Until patched, disable the shell tool for agents processing untrusted content or enforce out-of-band approval.