CVE-2026-18733 - Prompt injection bypasses shell tool consent gate in Strands Agents Tools

Summary

CVE-2026-18733 affects the shell tool in the strands-agents-tools package for Strands Agents, an open-source SDK for building AI agents, in versions below 0.8.0. The tool's input schema exposed a non_interactive parameter that the LLM could control, so a crafted prompt, including one delivered through untrusted content the agent reads, could set it to true. This bypasses the operator consent gate and allows arbitrary operating system commands to run on the agent's host without approval.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Topics

• Prompt injection and jailbreaks

Related items

• InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
• InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
• MediumDocker Sandboxes vulnerability lets AI agents access sensitive files outside their sandbox (CVE-2026-103916) | Endor LabsSimilar attack · Endor Labs Blog
• MediumFree the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak BundlesSimilar attack · Check Point Research
• InfoRight Tool, Wrong Parameters: Defending LLM Agents Against Parameter PoisoningSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)