Between July 15 and August 6, 2026, AWS Strands Agents Tools — the first-party tool package for the Strands Agents SDK — received four distinct security advisories. The vulnerabilities range from credential disclosure to arbitrary command execution, but they share a singular root cause: security-sensitive parameters were exposed as LLM-controllable inputs in the tool schema.
This is not a series of isolated bugs. It is a design pattern failure — one that recurs across memory tools, shell execution, HTTP routing, and credential management within the same package.
Four CVEs, One Root Cause #
The earliest advisory, CVE-2026-15746 (CVSS 6.5, July 15), disclosed credential exfiltration in the elasticsearch_memory
tool. The tool exposed its connection parameters — es_url
, cloud_id
, api_key
— as fields the LLM could control. When the api_key
parameter was omitted, the tool fell back to the operator’s environment variable. A crafted prompt could redirect the tool to an attacker-controlled server, sending the operator’s Elasticsearch API key in the Authorization header.
Two weeks later, CVE-2026-18394 (CVSS 6.9, July 31) exposed a similar flaw in the http_request
tool. The tool used HTTP_REQUEST_TOKEN_CONFIG
to bind credentials to an allowlist of hostnames — but it also exposed a proxies
parameter that was LLM-controllable. A prompt injection could set the proxy to an attacker’s endpoint. The allowlist check passed on the request URL, the Authorization header was injected, and the request was routed through the attacker’s proxy on the first hop. GET requests additionally bypassed the tool’s consent gate.
The most severe, CVE-2026-18733 (CVSS 8.8, August 3), involved the shell tool’s consent gate. The tool exposed a non_interactive
parameter in the LLM-controllable schema. Indirect prompt injection — via a web page, Slack message, or file the agent reads — could set non_interactive
to true, skipping the consent gate entirely. The result was arbitrary OS command execution on the host with the agent process’s privileges. AWS classified this under CWE-1427 (Improper Neutralization of Input Used for LLM Prompting), a weakness category specific to LLM-integrated systems.
Three days later, CVE-2026-19111 (CVSS 8.1, August 6) may be the most architecturally telling. The mongodb_memory
, elasticsearch_memory
, and mem0_memory
tools each used a namespace field as the sole tenant-isolation key for every record, list, retrieve, and delete operation. That namespace was exposed as an LLM-controllable parameter. The tools validated the namespace syntactically but did not verify that the caller was authorized to use it. A remote authenticated user could craft a prompt to forge a namespace — reading, modifying, or deleting another tenant’s memories, or injecting false memories to poison future agent context. The standalone MongoDB and Elasticsearch tools additionally exposed connection parameters, allowing the LLM to redirect the memory backend to an attacker-specified cluster.
The Fix Pattern #
Across all four advisories, the remediation followed the same structure: bind security-critical parameters when the tool is constructed, and remove them from the LLM-controllable schema entirely. In the fixed versions, the namespace is no longer a tool parameter. The non_interactive
flag no longer bypasses the consent gate. The proxy configuration is set through environment variables, not through the tool. The connection parameters are pinned at initialization.
This is not a novel insight in traditional software security — input validation and privilege separation are foundational. But agent-native tooling introduces a new category of risk: parameters that were never designed to be user-facing become user-controllable because the LLM mediates every interaction. The tool schema is the API, and the LLM is the caller.
What This Signals #
The CSA Agent Identity Governance Framework recommends Just-In-Time access and cryptographic workload attestation for agent identities. The FusionAuth 2026 AI Identity Report found that 66% of organizations have experienced an AI identity breach, with only 28% able to trace agent actions back to a human sponsor. The gap between governance frameworks and implementation reality is wide.
Strands Agents Tools is not a niche third-party library. It is AWS’s own tooling for its agent SDK, maintained at 1.2k GitHub stars and 327 forks. Four advisories in 23 days — two rated HIGH — in a first-party package signal that the agent-native stack is still working through security fundamentals that traditional infrastructure resolved decades ago.
The sequence extends the pattern documented across the MCP supply chain wave, the CoreBreak dispatch-layer bypass, and the ChatMate remote prompt execution class. The attack surface is not the model. It is the plumbing the model controls.