Amazon Strands Agents Shell Tool Prompt Injection to RCE via Consent Gate Bypass

Technical Analysis

The shell tool exposes a 'non_interactive' parameter intended for automation contexts, but it can be manipulated via untrusted input (e.g., content the agent reads or a crafted user/tool prompt) to suppress the human-in-the-loop confirmation step before executing shell commands. Entry point is any surface that feeds text into the agent's prompt/tool-call context, including tool outputs, retrieved documents, or direct user input, allowing indirect or direct prompt injection to reach the shell tool's parameters. Once triggered, the attacker gains arbitrary OS command execution on the host running the agent, crossing the boundary from a conversational/planning layer into a system-level execution layer. This effectively converts a designed safety gate (human consent) into an attacker-controlled bypass switch, with no additional exploitation steps required beyond crafting the injection payload.

Affected Systems

Amazon Strands Agents, Amazon Strands Agents Tools

Detection Signatures

• Tool invocation logs showing shell tool calls with non_interactive=true originating from model-generated or untrusted content rather than explicit user configuration
• Prompts or documents containing instructions referencing 'non_interactive', 'skip confirmation', 'bypass consent', or similar phrasing near shell/command execution context
• Unexpected shell tool executions with no corresponding human approval event in audit trail
• Spikes in shell tool usage correlated with ingestion of external/untrusted content (web pages, emails, files)
• Versions of strands-agents-tools < 0.8.0 in dependency manifests

Remediation Steps

1. 1

   Upgrade dependency

   Upgrade Amazon Strands Agents Tools to version 0.8.0 or later, which fixes the consent gate bypass.

2. 2

   Enforce server-side consent controls

   Do not allow model-generated or prompt-derived input to set safety-critical parameters like non_interactive; enforce these as fixed, developer-controlled configuration values outside the LLM's control.

3. 3

   Sandbox shell execution

   Run the shell tool in a restricted, least-privilege sandbox/container so that even a successful bypass limits blast radius on the host.

4. 4

   Audit and alert

   Log all shell tool invocations with parameter values and require alerts on any execution where the consent step was skipped.

5. 5

   Input sanitization

   Treat all external/retrieved content as untrusted and strip or neutralize instructions attempting to alter tool call parameters before they reach the agent's planning loop.