A Prompt Could Tell Strands Agents' Environment Tool to Stop Hiding Secrets, and AWS Has Now Assigned It CVE-2026-115415

An AI agent’s tools are only as safe as the inputs the model is allowed to set. In Strands Agents Tools, the switch that hid secrets in environment variables was one of those inputs, so a prompt hidden in a web page or file could ask the model to turn masking off and read every key on the host. AWS disclosed the flaw as CVE-2026-115415 on October 28, 2026, in security bulletin 2026-154-AWS and GitHub advisory GHSA-qjx4-hg6g-2f34.

Strands Agents Tools, published on PyPI as strands-agents-tools, is AWS’s open-source package of pre-built tools for the Strands Agents SDK. Its environment tool lets an agent list, read, set and delete environment variables on the machine it runs on. By default it masks values whose names look sensitive. The advisory gives examples of names containing KEY, TOKEN, SECRET or PASSWORD.

The masking flag lived in the model’s own schema

The trouble was where that default could be overridden. According to the advisory, the masked parameter that controlled the behaviour “was declared in the tool’s input schema, so the large language model (LLM) could set it.” The input schema is the interface the model uses to call a tool, so anything listed there is effectively under the model’s control, and by extension under the control of anyone who can steer the model.

A second gap made the first one quieter. Only the set and delete actions asked the operator for confirmation. The list and get actions ran without a consent prompt.

The attack AWS describes needs no access to the host. An actor who can place instructions in content the agent processes, such as a web page, a file or an earlier tool output, could direct the model to call the tool with action="list" and masked=false. The advisory says the tool would then return every environment variable unmasked, “such as AWS access keys, model provider API keys, source control tokens, and database connection strings.” The model could pass those values on through any other tool the agent had loaded.

GitHub’s advisory rates the issue 6.5 (medium) on CVSS 3.1, with a network attack vector, no privileges required, user interaction required and high confidentiality impact. It maps the flaw to CWE-522 (insufficiently protected credentials) and CWE-1427 (improper neutralisation of input used for LLM prompting). No reporter is credited.

A patch from August, a disclosure in October

Every release from 0.1.0 up to, but not including, 0.8.6 is affected. The fix is not new. Version 0.8.6 reached PyPI on August 7, 2026, and the underlying pull request, #545 in the strands-agents/tools repository, was merged on July 29. The advisory was published nearly three months after the patched release.

That pull request explains the change in plain terms. Because the tool read masked from its input on the list and get actions, “the agent could pass masked=false and have sensitive values returned in cleartext, overriding the ENV_VARS_MASKED_DEFAULT setting the operator configured.” After the change, masking is read only from that operator-set environment variable, which still defaults to true. The masked property was removed from the tool’s schema, and new tests check that a masked=False passed by the model has no effect.

The same 0.8.6 release deprecated the environment tool, along with a batch of others that the release notes describe as superseded by SDK capability, MCP servers, “or nothing.” Later releases kept trimming. Version 0.8.7 added a consent prompt in front of side-effecting use_aws actions. Version 0.8.9 deprecated http_request and several search and media tools. Version 0.8.10, released October 21, deprecated python_repl, a2a_client, mcp_client and mem0_memory.

What AWS asks operators to do

AWS recommends upgrading to the latest release and patching any forked or derivative code. Because exposure would already have happened on vulnerable versions, it also asks teams to rotate any credentials that were present in the environment of agents that loaded the tool.

For anyone who cannot upgrade straight away, the bulletin lists three workarounds: remove the environment tool from agents, avoid running agents with long-lived cloud credentials or API keys in the process environment, and restrict outbound network access from the agent host to trusted endpoints.

AWS’s bulletin does not mention any exploitation, and Writeble has not tested the issue. Its broader point applies beyond this package. Any value a model can set in a tool call should be treated as attacker-controlled once untrusted content is in the context window, and safety switches belong in operator configuration rather than in the tool schema.