What happened
AWS disclosed CVE-2026-78379 (CVSS 8.1) on Aug 25, 2026: improper neutralization of input used for LLM prompting in the python_repl tool lets an attacker bypass the human approval safeguard and achieve code execution via the batch tool's kwargs forwarding.
Why it matters
Strands Agents is AWS's first-party agent-building SDK; a consent-gate bypass defeats the primary safety control meant to prevent prompt-injection-driven code execution, meaning any application trusting that gate is silently exposed to full host compromise via injected prompt content.
Attack vector
A crafted prompt can forward non_interactive_mode as a keyword argument through the batch tool to the python_repl tool, bypassing the human consent gate that is supposed to require approval before executing Python code, allowing remote actors to execute arbitrary Python on the agent's host via prompt injection.
Affected systems
Amazon Strands Agents Tools, versions before 0.8.5; fixed in 0.8.5
Mitigation
Upgrade Amazon Strands Agents Tools to version 0.8.5 or later per AWS security bulletin 2026-089.