Strands Agents Tools python_repl Consent Gate Bypass via batch tool

Technical Analysis

The python_repl tool is designed to require explicit human consent before executing arbitrary Python code, acting as a safety checkpoint against untrusted or model-generated code execution. The flaw lies in improper neutralization of input used for LLM prompting: an attacker can supply a crafted prompt that routes through the batch tool and smuggles in a non_interactive_mode keyword argument, which suppresses the consent prompt and allows code to run unattended. The entry point is any interface where user or upstream-agent input reaches the LLM's tool-invocation layer (e.g., chat input, tool orchestration, or multi-agent delegation), meaning the attack crosses a trust boundary from prompt content into privileged tool execution. Successful exploitation grants the attacker arbitrary code execution on the host running the agent, which could lead to full system compromise, data exfiltration, or lateral movement depending on host privileges. This is a classic safety-gate bypass pattern where an input-validation gap in one tool parameter undermines an entire human-oversight control.

Affected Systems

Amazon Strands Agents Tools

Detection Signatures

• Prompts or tool-call payloads containing 'non_interactive_mode' as a keyword argument passed to batch or python_repl tools
• Unexpected invocation of python_repl without a corresponding human consent/approval log entry
• Batch tool calls that indirectly reference or forward parameters intended for python_repl
• Log entries showing python_repl execution timestamps with no preceding user-approval event
• Anomalous or unattended code execution sessions originating from agent orchestration layers

Remediation Steps

1. 1

   Upgrade Strands Agents Tools

   Update to version 0.8.5 or later, which fixes the improper input neutralization allowing the consent gate bypass.

2. 2

   Audit tool parameter forwarding

   Review batch tool and other multi-tool orchestration logic to ensure sensitive keyword arguments (like consent/mode flags) cannot be injected or forwarded from untrusted input.

3. 3

   Enforce server-side consent validation

   Do not rely solely on client- or prompt-controlled flags for safety gating; validate and enforce human consent requirements server-side, independent of LLM-controlled parameters.

4. 4

   Monitor python_repl execution logs

   Implement logging and alerting for any python_repl invocation lacking a corresponding explicit human approval event.

5. 5

   Restrict host privileges

   Run agent tool execution environments with least-privilege access and sandboxing to limit blast radius if consent bypass occurs.