AWS Fixes Strands Agents Flaw That Could Expose Cloud Credentials

AWS has published a security bulletin for CVE-2026-115415, a vulnerability in the environment tool included in Strands Agents Tools, an open-source Python package designed for use with the Strands Agents SDK.

The issue could allow a crafted prompt to cause an AI agent to retrieve environment variables in cleartext, including cloud credentials and API keys. According to AWS, the vulnerable tool accepted a secret-masking parameter supplied through the large language model's tool schema, allowing the model to disable masking without operator consent.

AWS has addressed the vulnerability in version 0.8.6 of strands-agents-tools. The release also deprecates the environment tool. AWS recommends upgrading, patching any forked or derivative implementations, and rotating credentials that were present in the environment of agents that loaded the affected tool.

Key details at a glance

Vulnerability

CVE-2026-115415

Secret-masking bypass in the Strands Agents Tools environment tool.

Affected versions

0.1.0 to versions below 0.8.6

The bulletin specifies versions greater than or equal to 0.1.0 and less than 0.8.6.

Resolution

Version 0.8.6

Masking is controlled by the operator, and the environment tool is deprecated.

Bulletin date

28 October 2026

AWS classified the bulletin as Important, requiring attention.

1. How the secret-masking vulnerability works

The affected environment tool can list, read, set and delete environment variables on the host running an AI agent. It masks values that appear to be secrets by default.

The vulnerability arose because the tool accepted a masking parameter from the language model through its tool schema. Content supplied to the agent could contain a crafted prompt that instructed the model to invoke the tool with masking disabled.

According to AWS, this could cause the tool to return environment variables in cleartext, including cloud credentials and API keys, without asking the operator for consent.

This is a security issue at the boundary between an AI model and the tools it can invoke. The model's ability to request a tool operation should not automatically give it authority to override a security control.

2. Which systems and versions are affected?

The AWS bulletin identifies strands-agents-tools versions greater than or equal to 0.1.0 and below 0.8.6 as affected.

The advisory concerns the environment tool within this open-source Python package, rather than establishing that every application using the Strands Agents SDK is vulnerable.

Organisations should identify whether their applications use the affected package and whether their agents loaded the environment tool. Teams maintaining forks or derivative implementations should also check whether they incorporated the vulnerable behaviour.

AWS does not disclose a list of affected customer deployments or provide a count of potentially exposed systems in this bulletin.

3. AWS's fix changes who controls secret masking

AWS addressed the issue in strands-agents-tools version 0.8.6.

The release introduces a key change: the operator controls masking, and the model can no longer disable it. AWS also deprecated the environment tool in that release.

This addresses the specific weakness described in the bulletin by preventing the language model from overriding the masking setting through its tool call.

For engineering teams, the distinction is important. A model may need to request operations to complete a task, but security-sensitive settings should remain under explicit control of the application or operator.

4. What organisations should do now

AWS recommends upgrading to the latest version, ensuring that forked or derivative code includes the fix, and rotating credentials that were present in the environment of agents that loaded the environment tool.

If immediate upgrading is not possible, AWS provides three additional recommendations:

• Remove the environment tool: Disable or remove it from affected agents until the issue can be addressed.

• Avoid long-lived credentials: Do not run agents with long-lived cloud credentials or API keys in their process environment.

• Restrict outbound network access: Limit connections from the agent host to trusted endpoints.

5. Why this matters for AI agent security

The bulletin highlights a broader industry challenge: AI agents can interact with software tools, system settings and operational data, so the security of an agent depends partly on the permissions and controls surrounding those tools.

Traditional application security often focuses on whether a user or service has permission to perform an operation. AI agents introduce another consideration: untrusted content may influence which tool operations a model requests.

In this case, the documented weakness involved a model-controlled parameter that could disable secret masking. The corrective approach keeps that setting under operator control.

For enterprises, the incident reinforces several practical principles:

• Keep security controls outside model discretion. Sensitive protections should not depend solely on instructions given to a model.

• Limit credential exposure. Avoid placing long-lived secrets in environments accessible to agent tools when possible.

• Review tool permissions. Every tool exposed to an agent should have a clearly defined purpose and appropriate access boundaries.

• Plan for credential rotation. Remediation should account for secrets that may have been exposed, not just the vulnerable software version.

These are broader security lessons drawn from the incident, not additional product capabilities or requirements announced by AWS.

6. What remains undisclosed

AWS's bulletin explains the affected versions, the vulnerability mechanism, the fix and recommended mitigations. However, it does not provide specific information about customer impact, confirmed exploitation, the number of affected deployments or whether credentials were accessed in real-world incidents.

Additional details were not disclosed in the announcement. Organisations should use the official advisory and their own environment assessments to determine their exposure.

Conclusion

CVE-2026-115415 demonstrates why AI agent tools need security boundaries that the model cannot override. AWS has addressed the secret-masking bypass in strands-agents-tools version 0.8.6, deprecated the affected environment tool and advised organisations to upgrade, patch derivative code and rotate potentially exposed credentials.

Teams that cannot upgrade immediately should follow AWS's workarounds, particularly removing the environment tool and restricting the agent host's outbound network access.

The immediate priority is to establish whether affected versions and tools were present, apply the appropriate remediation and assess any credentials that may have been exposed.