CVE-2026-78379

Executive Summary

CVE-2026-78379 is a high-severity (CVSS 8.1) prompt-injection vulnerability in the python_repl tool within Amazon Strands Agents Tools versions prior to 0.8.5. Improper neutralization of input used for LLM prompting allows a remote actor to execute arbitrary Python code on the agent's host by crafting a prompt that forwards non_interactive_mode as a keyword argument through the batch tool, thereby bypassing the human consent gate. The vulnerability requires no authentication (PR:N) but demands a non-trivial attack complexity (AC:H), reflecting the need for the victim agent to be reachable and to process untrusted prompts. Successful exploitation yields full confidentiality, integrity, and availability impact (C:H/I:H/A:H) on the underlying host. The vendor has released version 0.8.5 as a remediation; however, patch confidence is rated 0/4, meaning no patch evidence from externally tracked sources has been independently verified. No public proof-of-concept or exploit code is currently available.

Technical Analysis

The vulnerability resides in the python_repl tool, which is part of the Amazon Strands Agents Tools package — a set of tools designed to augment large language model (LLM) agents with code-execution capabilities. The flaw class is prompt injection combined with improper neutralization of input in the context of LLM prompting. In this case, the LLM or the agent orchestration layer does not adequately sanitize or restrict prompt content before it is passed to the python_repl tool for execution.

The attack mechanism is triggered via the batch tool, which is an execution path that presumably allows multiple operations to be queued or forwarded through a single orchestrated call. The crafted prompt forces the python_repl tool to receive non_interactive_mode as a keyword argument. The default behavior of the consent gate — a human-approval step that ordinarily requires a user to confirm code execution before it is run — is effectively bypassed when non_interactive_mode is set. This allows the tool to execute Python code without waiting for explicit human authorisation.

From a code-level perspective (inferred, since no specific source is provided), the python_repl tool likely has logic similar to:

if non_interactive_mode:
    # Skip the consent gate
    execute_code(prompt_content)
else:
    # Await human approval
    human_consent = request_approval()
    if human_consent:
        execute_code(prompt_content)

The vulnerability arises because an attacker can inject a prompt that causes the LLM to echo or forward non_interactive_mode=True as a keyword argument to the relevant function. Because the prompt content is not properly neutralised, there is no protection against the LLM passing this argument forward. This is a classic confused-deputy problem: the LLM acts as an intermediary and cannot be fully trusted to filter malicious instructions.

The attack surface is the agent host itself — any system running Amazon Strands Agents Tools version < 0.8.5 where the agent is reachable by an external actor (e.g., via an exposed API, chat interface, or document-processing pipeline). Since the CVSS vector shows AV:N, the vulnerability is exploitable over the network. The AC:H reflects that the attacker may need to carefully craft the prompt to defeat any existing LLM-level guardrails or to ensure the batch tool forwards arguments in a specific manner.

Notably, the NVD description does not specify whether authentication is required to reach the agent interface. The PR:N component indicates that no privileges are required, but this assumes the agent endpoint is already accessible. If the agent is behind a firewall or requires API keys, those would be additional prerequisites not captured by the CVSS vector.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class and the NVD description.

Step 1 — Reconnaissance / Target Identification:
An attacker identifies a publicly accessible LLM agent instance running Amazon Strands Agents Tools with a version prior to 0.8.5. This could be accomplished by fingerprinting the agent's response headers, observing exposed API endpoints, or searching for known deployment patterns (e.g., default ports, distinctive error messages). The attacker may also identify the python_repl tool as a feature by probing the agent with benign prompts and observing whether code-execution capabilities are advertised or inferable from response latency.

Step 2 — Vulnerability-Class Trigger:
The attacker crafts a prompt that instructs the LLM to use the batch tool to invoke the python_repl tool with the non_interactive_mode keyword argument set to True. The prompt is designed to be compelling or to use indirect injection (e.g., embedded in text retrieved from a URL, PDF, or email) to trick the LLM into following the instruction. Because the input is not properly neutralised, the LLM passes the argument through, and the consent-gate bypass condition is satisfied. No local file paths, API endpoints, or function signatures beyond python_repl, batch_tool, and non_interactive_mode are specified in the description, so the actual method of forwarding is implementation-specific.

Step 3 — Payload / Execution Method:
The attacker's prompt includes arbitrary Python code intended for execution. Since non_interactive_mode bypasses the consent gate, the code is executed on the agent's host without human approval. The code could be as simple as import os; os.system('id') for validation, or more damaging such as spawning a reverse shell, exfiltrating environment variables/secrets, modifying files, or installing persistence mechanisms. The specific language constructs are at the vulnerability-class level: arbitrary code execution via an LLM tool that lacks a gating mechanism.

Step 4 — Post-Exploitation Impact:
Once arbitrary code execution is achieved, the attacker effectively gains the privileges of the process running the agent (likely a service account). This could lead to:

• Confidentiality breach: Reading sensitive files (/etc/passwd, cloud credentials, database connection strings).
• Integrity compromise: Modifying application files, planting backdoors, or altering the agent's behaviour for future attacks.
• Availability impact: Disrupting the service or using the host as a pivot to other internal systems.

Given CVSS subscores of C:H/I:H/A:H, the attacker can fully compromise the host. The blast radius depends on the network architecture; if the agent host has access to other internal resources, the attacker could use it as a foothold for lateral movement.

Impact Assessment

Business Impact:
Organisations deploying LLM agents with code-execution tools (e.g., python_repl in Strands Agents Tools) face significant risk. A successful exploit allows an unauthenticated or low-privilege external actor to execute arbitrary code on the agent host. This can result in data exfiltration (including proprietary business data processed by the agent), unauthorised system changes, and service disruption. For organisations relying on agent-based automation for critical workflows, this vulnerability undermines trust in the automation layer and could erode compliance posture.

Affected Systems:
All deployments of Amazon Strands Agents Tools prior to version 0.8.5 that use the python_repl tool and allow interaction with untrusted LLM prompts. This includes internet-facing agents, internal agents that process documents or emails containing untrusted content, and any chained pipeline where prompts from multiple sources are combined.

Blast Radius:

• Directly affected: The host running the agent software.
• Indirectly affected: Any systems accessible from that host — databases, file shares, internal APIs, cloud instance metadata endpoints.
• User-affected: End users relying on the agent for correct, safe automation; any credentials or secrets exposed via the host.
• Reputational impact: Public disclosure of a successful LLM-agent compromise could damage an organisation's reputation, especially in regulated industries.

CVSS Subscore Reference:

• Attack Vector: Network (AV:N) — remotely exploitable.
• Attack Complexity: High (AC:H) — requires careful prompt crafting but no physical or logical access.
• Privileges Required: None (PR:N).
• User Interaction: None (UI:N) — the human consent gate is exactly what is bypassed; no user interaction is needed for the exploit to succeed.
• Scope: Unchanged (S:U) — compromise is confined to the vulnerable component's security authority.
• Confidentiality Impact: High — full read access to host data.
• Integrity Impact: High — full write/modify capability on host resources.
• Availability Impact: High — potential denial of service.

Detection Guidance

Sigma Rule

The following Sigma rule detects log entries associated with suspicious Python execution from an agent process, which may indicate exploitation of CVE-2026-78379:

title: Suspicious Python Execution via LLM Agent Tool
id: 9e1d7a3c-4f6b-4a9e-8c7d-2f0a5b6e1c3d
status: experimental
description: Detects execution of python processes spawned by an LLM agent with arguments suggesting code execution via a REPL tool, potentially indicating CVE-2026-78379 exploitation.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-78379
author: Valtersit Threat Research
date: 2026/01/15
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/python'
        ParentImage|endswith: '/python'
        CommandLine|contains:
            - '-c'
            - 'exec('
            - 'eval('
            - 'os.system'
            - 'subprocess'
    condition: selection
level: high
falsepositives:
    - Legitimate agent debugging or maintenance operations.
    - Developer-run scripts on the same host.

YARA Rule

The following YARA rule scans for malicious prompt-malware patterns likely used to exploit the python_repl tool:

rule CVE_2026_78379_python_repl_prompt_injection
{
    meta:
        author = "Valtersit Threat Research"
        description = "Detects prompt patterns attempting to trigger non_interactive_mode in amazon strands agents tools python_repl"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-78379"
        date = "2026-01-15"
    strings:
        $a = "non_interactive_mode" ascii wide
        $b = "batch_tool" ascii wide
        $c = "python_repl" ascii wide
        $d = "consent" ascii wide
        $e = "approval" ascii wide
    condition:
        2 of them and filesize < 1MB
}

Suricata IDS Rule

Suricata rule to detect network traffic containing suspicious LLM prompt payloads targeting agent endpoints:

alert tcp any any -> $HOME_NET any (msg:"CVE-2026-78379 - Amazon Strands Agents Tools LLM Prompt Injection Attempt"; flow:to_server,established; content:"non_interactive_mode"; nocase; content:"python_repl"; nocase; within:5000; sid:2026078379; rev:1; reference:cve,2026-78379;)

Elastic Detection

Elastic EQL query to identify process executions matching the exploit pattern:

process where event.category == "process" and process.name == "python" and process.parent.name == "python" and process.command_line in ("* -c *", "*exec(*", "*eval(*", "*os.system*", "*subprocess*")

Splunk SPL Query

Splunk query to surface suspicious audit logs and process activity around the agent host:

index=linux source="WinEventLog:Security" OR index=linux sourcetype=linux_audit
| where process_name=="python" AND parent_process_name=="python"
| search "exec(" OR "eval(" OR "os.system" OR "subprocess"
| table _time, host, user, process_name, parent_process_name, command_line
| sort -_time

Wazuh OSSEC Rule

Wazuh XML rule for suspicious Python execution from a Python parent process:

<group name="local,">
  <rule id="100247" level="12">
    <decoded_as>json</decoded_as>
    <field name="process_name">python</field>
    <field name="parent_process_name">python</field>
    <field name="command_line">\.\b(exec|eval|os\.system|subprocess)\b</field>
    <description>Potential CVE-2026-78379 python_repl exploitation via LLM prompt injection.</description>
    <group>pci_dss_6.5,</group>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source has been independently verified. The vendor recommends upgrading to version 0.8.5 or later; patch availability should be confirmed directly with Amazon.

1) Immediate Mitigations:

• Upgrade to version 0.8.5 or later if the vendor has released it. Verify the version number against the official package repository, as patch confidence is low.
• Disable the python_repl tool if not absolutely required for agent functionality. Configure the agent to operate in "safe mode" where code execution is disabled or restricted to a whitelist.
• If the non_interactive_mode flag can be blocked at the configuration level, do so regardless of version, to prevent the consent-gate bypass.
• Restrict network access to the agent host — place it behind a firewall, require TLS client certificates, or implement WAF rules to block suspicious prompt payloads.
• Run the agent process with the least-privilege service account and in a sandboxed container/micro-VM to limit blast radius.

2) Patch/Upgrade Steps:

• Monitor vendor advisories for the official patch release.
• Test the upgrade in a staging environment, verifying agent functionality and any breaking changes.
• Deploy the upgraded version to production, then verify that the python_repl tool no longer honours non_interactive_mode as a bypass vector.
• Refer to the vendor's upgrade guide for any additional configuration changes required.

3) Long-Term Hardening:

• Implement a human-in-the-loop policy for all LLM code-execution tools, ensuring that no flag or prompt can bypass the consent gate unilaterally.
• Add input sanitisation and validation layers for all prompts before they reach LLM tools; treat prompts as untrusted data, even from internal sources.
• Deploy runtime security monitoring (e.g., Falco, SYS-642) to detect anomalous process execution on agent hosts.
• Regularly audit agent logs for unusual python process activity.
• Develop a formal incident-response playbook for LLM-prompt-injection incidents, given the novelty and increasing prevalence of this vulnerability class.

References

1. NVD Entry for CVE-2026-78379: https://nvd.nist.gov/vuln/detail/CVE-2026-78379
2. Amazon Security Advisory (if available): Monitor https://aws.amazon.com/security/ for related advisories.
3. OWASP LLM Prompt Injection Guidance: https://owasp.org/www-community/attacks/LLM_Prompt_Injection
4. MITRE ATT&CK Technique T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-78379 not listed as of analysis date).

Exploit-in-the-Wild / Campaign Evidence: No public exploit code, PoC, Nuclei template, or threat-actor campaign associated with CVE-2026-78379 has been identified at the time of writing. Exploitation is likely to occur given the high impact and increasing adoption of agent-based LLM platforms; organisations should treat this as a high-priority patch candidate despite the lack of public exploit evidence.