Strands Agents Tools http_request Credential Exfiltration via Attacker-Controlled Proxy Routing

Technical Analysis

The http_request tool appears to apply configured authorization tokens (HTTP_REQUEST_TOKEN_CONFIG) to outgoing requests without properly validating or restricting the destination host/proxy the request is routed through. An attacker able to influence the agent's reasoning or input (e.g., via prompt injection, malicious tool descriptions, or manipulated task context) can steer the LLM into issuing a request configured to traverse an actor-controlled proxy, causing the tool to attach sensitive credentials to that outbound call. This crosses the boundary from a benign LLM-driven tool call into direct credential exfiltration, since the underlying HTTP client trusts the destination without domain/scope verification tied to the credential's intended target. The flaw sits at the intersection of prompt injection (entry vector) and insecure tool authorization logic (root cause), giving remote attackers a path to obtain secrets without any direct system compromise.

Affected Systems

Strands Agents Tools

Detection Signatures

• Outbound HTTP requests from agent tooling to unexpected or newly-registered proxy/host domains
• HTTP_REQUEST_TOKEN_CONFIG credentials appearing in request headers to non-allowlisted destinations
• Anomalous tool invocation patterns where LLM-generated URLs include unfamiliar proxy parameters or redirect chains
• Log entries showing http_request tool calls with destination hosts inconsistent with expected API endpoints

Remediation Steps

1. 1

   Upgrade Strands Agents Tools

   Update to version 0.8.2 or later, which fixes the authorization flaw in the http_request tool.

2. 2

   Restrict credential scope

   Configure HTTP_REQUEST_TOKEN_CONFIG credentials to be sent only to an explicit allowlist of trusted domains/endpoints, never attached based on LLM-controlled input.

3. 3

   Enforce destination validation

   Implement strict URL/host validation and disallow proxy redirection or user/LLM-influenced routing for any request carrying sensitive credentials.

4. 4

   Monitor outbound tool traffic

   Add egress monitoring and alerting for agent tool calls to unexpected hosts or proxies, especially those carrying authorization headers.

5. 5

   Harden prompts against injection

   Apply input sanitization and prompt-injection defenses to reduce the ability of untrusted input to influence tool call parameters like target URLs.