AWS disclosed a credential-exposure vulnerability in the open-source Python package strands-agents-tools. Versions from 0.1.0 up to, but excluding, 0.8.6 are affected when an agent loads the environment tool.
The failure was architectural. Secret masking was exposed as a parameter in the tool schema, which meant the model could be induced by hostile content to ask for an unmasked response. The tool’s list and get operations also lacked an operator-consent prompt. A prompt injection therefore did not need to break masking; it could persuade the model to disable it and return host environment variables—including credentials—into model context.
Version 0.8.6 moves masking under operator control and prevents the model from switching it off. AWS also deprecated the environment tool, recommends upgrading and patching forks, and advises rotating every credential present in the environment of an agent that loaded the tool. If an upgrade is not immediately possible, AWS recommends removing the tool, avoiding long-lived environment credentials and limiting outbound access to trusted endpoints.
The advisory describes possible onward transmission through another loaded tool, not evidence that exploitation or external exfiltration occurred. Installation alone also does not establish exposure: the affected agent must have loaded the environment tool.