Anything in an AI agent's tool schema is a value the model chooses, and anything the model reads can steer that choice. On 28 October AWS disclosed CVE-2026-115415, where the switch that hid secrets in a Strands Agents tool was one of those values, so a prompt injection could simply turn it off.
AG Tech Consulting's advice for clients this week: open the tool definitions of every agent you run in production and list each parameter that changes a security outcome: consent or approval flags, masking or redaction switches, destination URLs and proxies, credentials, tenant or namespace keys, and anything that ends up in a shell command. Move every one of them out of the model-facing schema and into operator configuration, upgrade strands-agents-tools to 0.8.6 or later if you use it, rotate any keys that sat in the environment of an agent that loaded the environment tool, and disconnect the nine MCP servers VulnCheck listed on 27 October until they ship fixes.
What AWS disclosed on 28 October
AWS Security Bulletin 2026-154-AWS and GitHub advisory GHSA-qjx4-hg6g-2f34 describe CVE-2026-115415 in strands-agents-tools, the open-source package of pre-built tools for AWS's Strands Agents SDK. GitHub rates it Moderate, CVSS 3.1 score 6.5.
The environment tool lets an agent list, read, set and delete environment variables on its host. By default it masks values whose names look like secrets, such as names containing KEY, TOKEN, SECRET or PASSWORD.
The problem was where that default lived. The masked parameter was declared in the tool's input schema, so the model could set it. The list and get actions also ran without an operator consent prompt; only set and delete asked.
The attack in the advisory needs no access to the server. Someone places instructions in content the agent processes, such as a web page, a file or an earlier tool's output. The model calls the tool with action="list" and masked=false, receives AWS access keys, model provider API keys, source control tokens and database connection strings in clear text, and can pass them out through another tool the agent has loaded.
Versions from 0.1.0 up to, but not including, 0.8.6 are affected. In 0.8.6 masking is set only by the operator through an environment variable, and the environment tool is deprecated. AWS also asks users to patch forks and to rotate every credential that was present where the tool ran. Neither advisory reports exploitation.
One detail matters for patch planning. Version 0.8.6 shipped on 7 August 2026, well before the advisory. Teams that upgrade only when a CVE appears ran the vulnerable version for that whole gap.
Not a one-off: five earlier Strands advisories, one root cause
The strands-agents-tools advisory list shows the same design mistake in five other tools during 2026. Each time, a control that should belong to the operator was a field the model could fill in.
Consent gate, shell tool: CVE-2026-18733 (GHSA-mqvc-p852-wf8x, High 8.8). A non_interactive parameter in the schema let an indirect prompt injection skip the human approval prompt and run OS commands. AWS classed it CWE-1427, Improper Neutralization of Input Used for LLM Prompting. Fixed in 0.8.0.
Consent gate, python_repl: CVE-2026-78379 (GHSA-qc8m-4887-8wwh, High 8.1). A crafted prompt forwarded non_interactive_mode as a keyword argument through the batch tool. Fixed in 0.8.5, where the flag is read only from the STRANDS_NON_INTERACTIVE environment variable.
Destination and credential, elasticsearch_memory: CVE-2026-15746 (GHSA-ppcf-fpr3-x46v, 6.5). es_url, cloud_id and api_key were model-controllable, and an omitted key fell back to the operator's ELASTICSEARCH_API_KEY, which could then be sent to an attacker's server (CWE-918). Fixed in 0.7.0.
Proxy, http_request: CVE-2026-18394 (GHSA-qhw6-2h72-m84v). The hostname allowlist in HTTP_REQUEST_TOKEN_CONFIG checked the request URL, but the model could set proxies, so the attached token travelled through an attacker's proxy. GET requests also skipped the consent gate (CWE-863). Fixed in 0.8.2.
Tenant key, memory tools: CVE-2026-19111 (GHSA-mpxq-953j-42m4, High 8.1). In mongodb_memory, elasticsearch_memory and mem0_memory, a model-controllable namespace was the only tenant-isolation key. It was checked against a regex, not against who was asking, so one tenant could read, delete or poison another's memories (CWE-639). Fixed in 0.8.3.
Validation was present in several of these. It checked format, not authority. A namespace that matches ^[A-Za-z0-9_-]{1,64}$ is well formed; it is not necessarily yours.
The same mistake at the shell: VulnCheck's nine MCP CVEs
On 27 October VulnCheck published nine advisories for open-source MCP servers that wrap command-line tools. Eight are OS command injection (CWE-78) rated CVSS v4 7.3 to 8.5. None names a patched version.
The root cause is shared. Each server builds one command string from model-supplied values and hands it to a shell: subprocess.run(shell=True) in Kali-GPT (CVE-2026-117569) and hagent (CVE-2026-117573), asyncio.create_subprocess_shell in esp-mcp (CVE-2026-117567), child_process.exec in mcp-ffmpeg (CVE-2026-117568), and execSync in Codefriar sf-mcp (CVE-2026-117561) and the ai-sdlc plugin (CVE-2026-117558).
A backtick or $() inside a parameter such as target, ports, videoPath or repo ends the intended command and starts another, running as the MCP server user. In sf-mcp a hand-written escapeValue() missed both. DroidMind (CVE-2026-117559) checked the command name against an allowlist but not the substitutions inside its arguments.
The ATXP Gemini CLI extension (CVE-2026-117560) shows how short the path from content to shell can be: the advisory says instructions planted in an email or SMS can inject substitutions into message_id, subject or query. The ninth advisory, nmap-mcp (CVE-2026-117570, 4.8), is an allowlist that still let callers pass exploit, dos, brute and intrusive NSE script categories.
Several of these advisories name prompt-injected agents as an expected attacker. The researcher credited on the Kali-GPT, mcp-ffmpeg and esp-mcp advisories is Nguyễn Văn Tiến.
Denylists lose: AWS MCP Server run_script
On 23 October AWS published CVE-2026-115845 for the run_script tool in AWS MCP Server, its managed MCP server that gives agents access to AWS and runs Python scripts in a sandbox. The Python code validator had "an incomplete list of disallowed inputs", which might let an authenticated user execute arbitrary code inside their own isolated session.
AWS fixed it service-side and no customer action is required. The lesson is about design, not this bulletin: when model-written code or arguments are checked against a list of forbidden things, the attacker only needs the one the list forgot. The session isolation is what limited the impact.
The design rule: the model proposes, the host decides
Treat every field in a tool schema as attacker-supplied, because indirect prompt injection makes it so. Then sort parameters into two groups.
Task parameters describe what to do: a query, a file to read, a date range. The model can choose these, within validated limits.
Control parameters decide whether it is safe: consent, masking, redaction, destinations, credentials, tenant identity, execution mode. These must come from operator configuration, the authenticated session or the environment, which is how Strands fixed masked, non_interactive_mode and namespace.
For anything that touches a shell, pass an argument array with no shell, and validate each value against what the tool needs rather than escaping what it fears. Put authorization inside the tool or the downstream system, where the model cannot talk its way past it. OWASP's LLM06:2025 Excessive Agency entry makes the same point about limiting functionality, permissions and autonomy.
Future security risks to plan for
1. Schema drift. Every new tool or optional parameter widens what the model can set. A safe agent today can become unsafe after a routine tool upgrade, so tool schemas need review like any API change.
2. Tool chaining. CVE-2026-78379 needed batch and python_repl on the same agent. CVE-2026-115415 needed a read tool plus any tool that can send data out. Risk is a property of the tool set, not of each tool alone.
3. Shared memory poisoning. CVE-2026-19111 showed that forged memories can be written into another tenant's namespace. As agents keep long-term memory, a single poisoned record can shape future answers for someone else.
4. Community MCP servers without fixes. All nine VulnCheck advisories list no patched version. Expect more servers that wrap CLIs, written quickly and installed by individual developers outside any review.
A checklist for CTOs
Inventory every agent, its tool list and its MCP servers, including those on developer laptops. Upgrade strands-agents-tools to 0.8.6 or later and remove the deprecated environment tool. Rotate every credential that was in the environment of an agent that loaded the environment tool, and the ELASTICSEARCH_API_KEY if you ran elasticsearch_memory before 0.7.0. Disconnect or isolate ai-sdlc, DroidMind, ATXP Gemini CLI extension, sf-mcp, esp-mcp, mcp-ffmpeg, Kali-GPT, nmap-mcp and hagent until fixes ship. Grep tool code for shell=True, exec, execSync and create_subprocess_shell with interpolated arguments; replace them with argument arrays. Remove consent, masking, proxy, URL, credential and tenant fields from model-facing schemas; read them from operator config or the session. Require consent for reads of sensitive data, not only for writes and deletes. Keep long-lived cloud keys out of agent process environments; use short-lived, scoped credentials. Restrict agent egress to an allowlist of endpoints so a leaked secret has nowhere to go. Add red-team cases that ask the model to set control parameters, chain tools and inject $() into arguments.
The bottom line
None of these flaws needed a clever jailbreak. They needed a security decision to sit where the model could make it.
The fix is structural and cheap: the model proposes actions, and the host decides whether they are allowed. If a parameter can make your agent less safe, it does not belong in the tool schema.
Sources
https://aws.amazon.com/security/security-bulletins/2026-154-aws/ https://github.com/strands-agents/tools/security/advisories/GHSA-qjx4-hg6g-2f34 https://github.com/strands-agents/tools/releases https://github.com/strands-agents/tools/security/advisories/GHSA-mqvc-p852-wf8x https://github.com/strands-agents/tools/security/advisories/GHSA-qc8m-4887-8wwh https://github.com/strands-agents/tools/security/advisories/GHSA-ppcf-fpr3-x46v https://github.com/strands-agents/tools/security/advisories/GHSA-qhw6-2h72-m84v https://github.com/strands-agents/tools/security/advisories/GHSA-mpxq-953j-42m4 https://www.vulncheck.com/advisories/kali-gpt-through-commit-a608c74-os-command-injection-via-mcp-scanner-tool-parameters https://github.com/advisories/GHSA-rjw8-q97p-7xhf https://github.com/advisories/GHSA-533h-cccj-x6hp https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-110845 https://theinjection.dev/items/vulncheck-mcp-tool-parameter-command-injection/ https://aws.amazon.com/security/security-bulletins/2026-149-aws/ https://cwe.mitre.org/data/definitions/1427.html https://genai.owasp.org/llmrisk/llm062025-excessive-agency/
Also on our website: https://agtechconsulting.ai/insights/your-agent-safety-switch-is-a-tool-argument-model-can-flip-it.html
Want help reviewing your agents' tool schemas, MCP servers and credentials before an attacker does, or designing approval and egress controls your security team can sign off? Email avinash@agtechconsulting.ai, visit agtechconsulting.ai, or book a 30-minute call: https://calendly.com/avinash-dubey-30-min-catchup/meeting-with-ag-tech
Thanks to Amazon Web Services (AWS) , VulnCheck , Patrick Garrity 👾🛹💙 , Anthropic , Model Context Protocol , OWASP GenAI Security Project , Steve Wilson , MITRE , GitHub , Google , Salesforce , Elastic , MongoDB , Mem0 , Simon Willison , Johann Rehberger for the work this builds on.
Originally published on LinkedIn in the Your CTO Advisor newsletter: read and comment on LinkedIn →
