The Strands Agents Tools environment tool exposed a masking parameter to an agent, allowing the model to choose false and request unredacted host environment variables. An application must make the affected environment tool available and allow an agent or injected prompt to influence its masking option. Cloud credentials or provider keys in the tool host…
Inspect the ClaimsCase · DiggingBeagle record
Strands environment tool let model instructions disable secret masking
The Strands Agents Tools environment tool exposed a masking parameter to an agent, allowing the model to choose false and request unredacted host environment variables. Cloud credentials or provider keys in the tool host environment could be returned to the model even though the operator expected sensitive values to be hidden.
Scope
An application must make the affected environment tool available and allow an agent or injected prompt to influence its masking option. The disclosure demonstrates an authorization design flaw, not confirmed customer credential theft.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
The cited primary technical report or advisory supports the stated mechanism within its reported scope. The assessment does not infer a production breach, a victim count or a comparable impact score from a laboratory result. A maintainer or advisory names a patched release; that does not prove every deployed instance has updated. Boundary: A masking argument is a security policy decision, not a harmless tool display preference.
Assessed Oct 29, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP23-STRANDS-ENV-MASKING-1 · CLM-ENRICH-20261029-31 · Strands Agents Tools environment masking bypass advisory
At a glance
Cloud credentials or provider keys in the tool host environment could be returned to the model even though the operator expected sensitive values to be hidden.
Read the implicationsThe disclosure demonstrates an authorization design flaw, not confirmed customer credential theft.
Limits and uncertaintyFull account
The Strands Agents Tools environment tool exposed a masking parameter to an agent, allowing the model to choose false and request unredacted host environment variables.
An application must make the affected environment tool available and allow an agent or injected prompt to influence its masking option. Cloud credentials or provider keys in the tool host environment could be returned to the model even though the operator expected sensitive values to be hidden.
The disclosure demonstrates an authorization design flaw, not confirmed customer credential theft. Upgrade strands-agents-tools to 0.8.6 and enforce secret redaction in trusted host code rather than model-controlled tool arguments.
Evidence interpretation and control boundary. A masking argument is a security policy decision, not a harmless tool display preference. When model-controlled arguments can set masking to false, lower-trust prompt content can cause an environment inspection tool to reveal host process variables that may include credentials. The default tool permissions and actual environment contents determine what is disclosed; the advisory does not show a stolen customer key or a shell escape.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
Claims & evidence
CLM-ENRICH-20261029-31The Strands Agents Tools advisory identifies the environment tool’s model-selectable masking argument as a route for exposing process environment variables and lists a patched tool release.supported
Basis: reported finding
- supportsStrands Agents Tools environment masking bypass advisoryprimary disclosure
GHSA-qjx4-hg6g-2f34: masking false, environment tool effect, affected versions
CLM-CP23-STRANDS-ENV-MASKING-1The Strands Agents Tools environment tool exposed a masking parameter to an agent, allowing the model to choose false and request unredacted host environment variables. An application must make the affected environment tool available and allow an agent or injected prompt to influence its masking option. Cloud credentials or provider keys in the tool host environment could be returned to the model even though the operator expected sensitive values to be hidden.supported
Basis: reported finding
- supportsStrands Agents Tools environment masking bypass advisoryprimary disclosure
GHSA-qjx4-hg6g-2f34: masking false, environment tool effect, affected versions
Implications
Cloud credentials or provider keys in the tool host environment could be returned to the model even though the operator expected sensitive values to be hidden.
Controls and mitigations
- Upgrade strands-agents-tools to 0.8.6 and enforce secret redaction in trusted host code rather than model-controlled tool arguments.
Unknowns and contradictions
- The disclosure demonstrates an authorization design flaw, not confirmed customer credential theft.
Sources and citation
Material revision history
- Oct 29, 2026 · Canonical change recorded · new in release · revision 202