The Agent Asked for Consent. Its Batch Tool Answered for the Operator.
AWS has fixed a consent-bypass vulnerability in the open-source Strands Agents Tools package. A crafted prompt could use one agent tool to silently change how another tool handled approval, turning a human-in-the-loop checkpoint into arbitrary Python execution on the agent’s host.
The flaw is tracked as CVE-2026-78379. It affects strands-agents-tools versions before 0.8.5 and requires both the batch and python_repl tools to be registered on the same agent.
AWS does not report confirmed exploitation. No public proof of concept was identified in the sources reviewed for this article. The vendor’s description nevertheless provides enough detail to show why the boundary failed and why teams using these tools should not wait for evidence of abuse.
The approval prompt trusted a caller-controlled flag
Strands Agents is an open-source Python SDK for building AI agents. Its tools package includes python_repl, which executes Python code on the host, and batch, which invokes several tools in one request.
The Python tool was designed to ask the operator for consent before running code. The vulnerable implementation also accepted a non_interactive_mode setting as an argument. A remote actor who could influence the agent’s prompt could route that setting through the batch tool and cause python_repl to skip the human approval gate.
The model did not need to break out of a kernel sandbox or exploit the Python interpreter. The control failed one level earlier: a less-trusted tool invocation was allowed to alter the policy state of a more dangerous tool.
That distinction connects directly to BlackTree’s earlier analysis, When AI Agents Leave the Sandbox. Agent security depends on enforced boundaries around the model. An approval prompt is not an enforcement boundary if the workflow being approved can also decide that approval is unnecessary.
Exposure depends on the tool combination
| Condition | Status |
|---|---|
| Vulnerability | CVE-2026-78379, arbitrary Python execution through consent bypass |
| Affected versions | strands-agents-tools before 0.8.5 |
| Required configuration | Both batch and python_repl registered on the same agent |
| Attacker path | Untrusted content or a remote actor able to shape a prompt processed by the agent |
| Fixed version | 0.8.5 |
| Workaround | Remove either batch or python_repl, and do not expose Python execution to untrusted content |
| Exploitation status | No confirmed malicious exploitation reported |
| PoC status | No public proof of concept identified in the reviewed sources |
These prerequisites matter. An installation that never registers python_repl cannot be exploited through this path. An agent that registers the Python tool but not batch does not expose the demonstrated bypass. Risk concentrates in applications that combine both tools and process input an attacker can influence.
The impact can still be severe. Python runs with the permissions, network reach and credentials of the host process. In a poorly isolated environment, code execution could expose local files, cloud credentials, internal services or downstream automation.
The patch moves the decision to operator-controlled state
Version 0.8.5 changes where python_repl obtains the non-interactive setting. The tool now reads it only from the STRANDS_NON_INTERACTIVE environment variable. A caller can no longer forward the flag as a keyword argument through the batch tool.
That is the correct direction. Whether code may execute without confirmation is an operator policy. It should be established outside the model’s prompt and outside any argument list that another tool can construct.
What teams should do
- Upgrade
strands-agents-toolsto 0.8.5 or later. - Check forks and copied tool implementations for the same caller-controlled
non_interactive_modepattern. - Until upgrading, remove either
batchorpython_replfrom every affected agent. - Do not make Python execution available to agents that process untrusted documents, messages, web pages or retrieval results unless the execution environment is strongly isolated.
- Run agent tools with least privilege, narrow network egress and short-lived credentials.
- Log tool arguments, approval decisions and the final process activity separately so investigators can determine whether consent was genuinely provided.
The security lesson is simple: human approval is only as strong as the code that decides when to ask. When the agent can influence that decision through another tool, the human is no longer in the loop.
Sources and further reading
- AWS Security Bulletin 2026-089-AWS, published 25 August 2026 at 12:00 PDT, 19:00 UTC.
- GitHub advisory GHSA-qc8m-4887-8wwh, published 25 August 2026. The source provides no publication time.
