A local actor able to create entries in a shared temporary directory can replace the pending state path with a symlink. Subsequent session persistence may overwrite an unintended file or load tainted conversation memory on resume. The Strands security advisory identifies a symlink attack against default FileSessionManager storage leading to unintended file…
Inspect the ClaimsCase · DiggingBeagle record
Strands session file storage exposed local symlink and resumed-memory poisoning paths
The default session manager wrote agent state through predictable filesystem paths susceptible to a local attacker’s symlink substitution.
Scope
A local write capability and predictable storage layout are prerequisites, so the report must not be presented as a universal unauthenticated remote exploit.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
The advisory identifies default world-writable temporary session storage, predictable .tmp files and symlink-following writes. Local filesystem access is a prerequisite, with patch version 1.48.0; it is not a remote attack by arbitrary chat text. Impact is left ungraded because a calibrated 0-to-4 impact basis for actual affected targets is unavailable from these Claims.
Assessed Oct 28, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP22-020-A · CLM-CP22-020-B · CLM-ENRICH-20261028-015 · Strands FileSessionManager symlink and file integrity advisory
At a glance
The exact prevalence of shared temporary directories and actual downstream side effects is unknown.
Limits and uncertaintyFull account
A local actor able to create entries in a shared temporary directory can replace the pending state path with a symlink. Subsequent session persistence may overwrite an unintended file or load tainted conversation memory on resume.
The Strands security advisory identifies a symlink attack against default FileSessionManager storage leading to unintended file modification under the agent process permissions. The report also notes that a forged saved session could influence an agent resumed from that state; this requires a writable local path and does not imply remote prompt injection by any chat user. Primary evidence.
A local write capability and predictable storage layout are prerequisites, so the report must not be presented as a universal unauthenticated remote exploit.
Use per-user private session directories, atomic no-follow file creation and integrity verification before restoring agent decisions.
Claims & evidence
CLM-CP22-020-AThe Strands security advisory identifies a symlink attack against default FileSessionManager storage leading to unintended file modification under the agent process permissions.supported
Basis: reported finding
- supportsStrands FileSessionManager symlink and file integrity advisoryprimary disclosure
Advisory; symlink threat model and affected storage
CLM-CP22-020-BThe report also notes that a forged saved session could influence an agent resumed from that state; this requires a writable local path and does not imply remote prompt injection by any chat user.supported
Basis: reported finding
- supportsStrands FileSessionManager symlink and file integrity advisoryprimary disclosure
Advisory; session tampering implications
CLM-ENRICH-20261028-015The advisory says FileSessionManager placed predictable temporary files under /tmp/strands/sessions/ and followed pre-placed symlinks; the fixed version is strands-agents 1.48.0.supported
Basis: reported finding
- supportsStrands FileSessionManager symlink and file integrity advisoryprimary disclosure
Root Cause and Patched versions, GHSA-3w55-933p-8pv5
Controls and mitigations
- Use per-user private session directories, atomic no-follow file creation and integrity verification before restoring agent decisions.
Unknowns and contradictions
- The exact prevalence of shared temporary directories and actual downstream side effects is unknown.
Sources and citation
Material revision history
- Oct 28, 2026 · Canonical change recorded · new in release · revision 199