A crafted prompt slips past the human approval gate on Amazon's Strands agent toolkit

What happened

AWS published a bulletin on Strands Agents Tools, where python_repl runs Python on the agent's host and is supposed to ask the operator first. A crafted prompt forwards non_interactive_mode as a keyword argument through the batch tool, the consent gate is skipped, and a remote actor gets arbitrary Python on the host. NVD carries it at 9.2 critical on CVSS 4.0 and 8.1 high on CVSS 3.1, both scores set by AWS as the numbering authority.

Every release below 0.8.5 is affected. The fix makes python_repl read non_interactive_mode only from the STRANDS_NON_INTERACTIVE environment variable, so an external caller cannot set it. AWS's workarounds are to drop either batch or python_repl from the tool list, since the chain needs both, to keep python_repl away from agents handling untrusted content, and to run agents in isolated least-privilege environments.