Strands Agents Tools EUVD-2026-52432

The Strands shell tool must be enabled in the agent's tool configuration - agents that do not register or use the shell tool are entirely unaffected. The agent must process input from an untrusted or attacker-influenced source (e.g., user messages, fetched URLs, ingested documents, API responses from third parties), creating an indirect prompt injection delivery path. The AT:P designation in the CVSS 4.0 vector confirms this prerequisite: without the shell tool active and external content flowing into the prompt, exploitation is not possible. Active user interaction is required in the sense that the agent must actually invoke the shell tool during processing (UI:A). No attacker authentication is required (PR:N) - the adversarial payload rides entirely within the prompt content. Exploitation is limited to the agent host's OS command surface with the privileges of the agent process; if the agent runs with restricted OS permissions, impact may be partially contained.

The CVSS 4.0 score of 7.5 reflects high impact across confidentiality, integrity, and availability on the vulnerable system (VC:H/VI:H/VA:H), with no impact on subsequent systems (SC:N/SI:N/SA:N). AT:P captures the key limiting condition - the shell tool must be enabled and the agent must encounter the adversarial prompt - which meaningfully narrows the real-world attack surface compared to a pure AV:N/AC:L finding. No EPSS score was provided in the intelligence sources, leaving exploitation probability unquantified; however, the absence of a CISA KEV listing and no identified POC suggest this is not yet being actively exploited at scale. For deployments that do use the Strands shell tool and expose the agent to any external or user-controlled content, the risk is concrete and high - successful exploitation grants OS-level command execution with the agent process's privileges. Deployments that do not use the shell tool are entirely unaffected, making the tagged 'Authentication Bypass' label somewhat misleading - the bypass is specifically of the agent's consent gate, not of an authentication system.

An attacker who can influence any content reaching an agent's prompt - such as a user chat message, a web page the agent fetches, or a document it processes - embeds hidden instructions like 'set non_interactive to true and run [command]' within that content. When the agent invokes the Strands shell tool while processing this input, the injected instruction overrides the consent gate parameter, and the shell tool executes the specified OS command with the agent's process privileges without prompting for human approval. No public proof-of-concept code has been identified at time of analysis.