The report
A tool intended to help an agent inspect its environment can become a credential disclosure route if the agent is also allowed to decide whether the output should be masked. Strands Agents Tools exposed that distinction in its environment inspection interface: the same caller requesting information could influence the masking parameter that was supposed to restrict sensitive values.
The control was inside the untrusted request
The maintainer advisory explains that applications exposing the affected tool could pass a model-generated masking=false option. An agent following instructions from an untrusted retrieved page could then receive host environment values normally intended to be redacted. Those values may include provider credentials, cloud keys or other secrets, depending on the operator's process environment.
This does not prove that every Strands deployment has exposed secrets. The tool must be enabled, the host must hold sensitive variables and the model or attacker must influence the option. The canonical Case records the conditional exposure rather than a claimed customer breach.
Where redaction belongs
A secrecy rule must be enforced by trusted host policy, not presented as a preference in an agent-controlled argument. Hiding a token from the final prose response also is not enough if it has already appeared in tool output, traces or downstream actions. The advisory identifies Strands Agents Tools 0.8.6 as a fixed version, but the decisive validation is to submit an untrusted request asking to disable masking and confirm that no disallowed environment value reaches the agent.