The report
Agent sessions are often treated as harmless saved conversation state. Strands' FileSessionManager advisory shows why their storage paths need the same integrity rules as other privileged files: a process can write through a symbolic link planted by a local attacker, then later resume from modified state. The original boundary is filesystem control, not an ordinary chat message. Advisory scope.
The report identifies predictable storage under /tmp/strands/sessions/, where unsafe path handling could allow writes to targets reachable with the agent process's permissions. A separate resumed-session path matters because saved instructions and history can influence future agent behavior. Neither effect implies that any unauthenticated internet user could alter arbitrary sessions without first controlling the relevant local path. Local prerequisites.
The advisory lists strands-agents 1.48.0 as patched. Operators should verify the installed library, filesystem ownership and permissions of persistent session directories, and whether an untrusted local user or workload can substitute a path before the agent writes or resumes. Patch information.
This vulnerability also exposes a broader design distinction. A session file is both an operational recovery artifact and an input to a reasoning system. Protecting it against unintended writes reduces filesystem risk; protecting the interpretation of recovered approvals and instructions requires a separate authorization check. The disclosure demonstrates the former defect directly and makes the latter a meaningful deployment question, not a measured production outcome.