The vulnerability in the environment tool of Strands Agents Tools version 0.8.6 and earlier arises from improper neutralization of input used in LLM prompting. A crafted prompt can de‑activate the tool’s secret‑masking feature, causing the tool to reveal the agent host’s environment variables to the LLM. Attackers with remote access to the agent can therefore obtain sensitive values such as cloud credentials and API keys in cleartext, potentially enabling full account compromise.

Affected systems are Amazon Strands Agents Tools deployments that load the environment tool. Any version of the tool before 0.8.6 is vulnerable, especially if the environment tool is enabled on agents running on cloud or local hosts. The vulnerability exists regardless of the underlying operating system; it is specific to the tool’s handling of prompt input.

The severity is moderate, with a CVSS score of 5.9 and no EPSS score available, indicating that while the flaw is not immediately exploitable on a massive scale, it poses a significant confidentiality risk. The vulnerability requires that the attacker be able to send a prompt to the LLM through the agent, so it is inferred that the attack vector is remote via the LLM interface. The flaw has not yet been reported in the CISA KEV catalog, but exposed credentials can lead to severe downstream compromises.