The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Yes—but the phrase covers three distinct security findings, not one vulnerability. A flaw in the open-source Strands Agents HTTP tool could expose credentials through an attacker-controlled proxy; researchers demonstrated a separate prompt-injection path to credentials in an AgentCore Harness process; and a Bedrock AgentCore API flaw allowed a tool call to be dispatched without a model turn authorizing it. The first two put credentials at risk. The third bypassed a tool-authorization check. Their prerequisites, affected components and fixes differ.
What the three findings do—and do not—have in common
All three concern controls around AI-agent tools, but they are not interchangeable. In the Strands case, a hostname allowlist did not prevent a credential-bearing request from passing through an attacker-controlled proxy. In the AgentCore Harness demonstration, prompt injection led to shell activity that could read a credential already present in process memory. In CoreBreak, the reported failure was at the tool-dispatch layer: an authenticated API caller could request a tool action without the model producing an authorizing turn.
As an Amazon Associate I earn from qualifying purchases.
| Finding | Prerequisite described by the source | Primary risk | Model turn required? | Status or operator response |
|---|---|---|---|---|
CVE-2026-18394, Strands Agents Tools http_request |
Indirect prompt injection could influence the tool’s proxy parameter. | Exposure of a downstream credential in an Authorization header. | The attack uses an agent request; the credential is attached after the target hostname check. | AWS says versions earlier than 0.8.2 are affected and 0.8.2 addresses the issue. |
| AgentCore Harness credential-memory demonstration | Prompt injection steered the default shell tool in the setup examined by Unit 42. | Reading plaintext credentials from the harness process memory. | Yes, the reported chain used an agent responding to injected content. | Unit 42 says AWS closed its report as informative and pointed to customer-side controls. |
| CVE-2026-18830, CoreBreak | An authenticated caller submitted a tool-use block in an InvokeHarness request. | Unauthorized tool execution through dispatch without a genuine model decision. | No, according to the Cloud Security Alliance (CSA) account of the finding. | CSA says AWS deployed a managed-service fix automatically before July 31, 2026. |
These reports do not establish how many customer deployments were affected, that attackers exploited them in the wild, or that customer credentials were stolen. A proof of concept demonstrates a possible attack path; it is not evidence of customer compromise.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →How CVE-2026-18394 could expose a Strands credential
AWS described this as an incorrect-authorization flaw in the pre-built http_request tool from strands-agents-tools, the tools package for the open-source Strands Agents SDK. The affected setup used HTTP_REQUEST_TOKEN_CONFIG to bind credentials to approved hostnames. But the tool schema also exposed a proxies parameter that the language model could control.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
An attacker who could get malicious instructions into content the agent read could use indirect prompt injection to influence that parameter. AWS’s July 31, 2026 security bulletin says: “A crafted prompt, for example one delivered through untrusted web content the agent reads (indirect prompt injection), could set proxies to an actor-controlled endpoint.” The target URL could still pass the hostname allowlist, and the tool could attach the configured credential. Because the hostile proxy was the first hop, it could see the Authorization header in cleartext. The issue was proxy handling—not simply a hostname allowlist that accepted an unapproved destination.
Affected versions and AWS’s remediation
AWS bulletin 2026-069-AWS lists strands-agents-tools versions earlier than 0.8.2 as affected and says the issue is addressed in 0.8.2. AWS advises upgrading, patching forks or derivative implementations, and rotating credentials configured through HTTP_REQUEST_TOKEN_CONFIG, including when exposure has not been confirmed.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
If an upgrade cannot happen immediately
AWS advises against using the affected credential-binding setup with an http_request tool exposed to untrusted content until it is upgraded. If a proxy is required, configure it out of band through the HTTP_PROXY and HTTPS_PROXY environment variables rather than allowing the model to choose the proxy in a tool call.
What Unit 42 demonstrated in AgentCore Harness
In research published September 18, 2026, Palo Alto Networks Unit 42 examined AgentCore Harness with AgentCore Identity and a downstream MCP server. In the setup it tested, the built-in shell tool was enabled by default. Unit 42 reported that prompt injection in a support ticket could steer shell activity to read plaintext credentials from the same process memory in which a vault reference had been resolved for use.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
In its proof of concept, the researchers reported extracting a service-account JWT and sending it to an external webhook. CSA’s September 19 synthesis says the demonstrated JWT was 1,034 bytes; that size describes the demonstration, not the scale of impact. This was a researcher demonstration, not evidence that customer deployments were compromised. Encryption of a vault secret at rest or in transit does not stop a permitted runtime tool from reading it after it has been resolved into plaintext in shared process memory.
What AWS’s response means for operators
Unit 42 says AWS reviewed its disclosure and closed it as informative under the shared responsibility model, citing customer controls. That is distinct from AWS publishing a package fix for the Strands issue or reporting a managed-service fix for CoreBreak. Unit 42’s operator advice is to restrict the harness’s allowedTools, apply least privilege to service identities used with the identity vault, and monitor outbound traffic from harness containers. As Unit 42 put it in its guidance: “Scope the allowedTools the harness can use to what it needs.”
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
CSA’s September 19 summary says shell and file-operation tools are default tools unless restricted through allowedTools. For this attack path, narrow tool access matters because an agent prompt is not a security boundary around a shell that can inspect its own process environment.
How CoreBreak bypassed model-level tool decisions
CoreBreak, presented by Hedi Ingber and Aviyam Ivgi at Black Hat USA 2026, concerned the Bedrock AgentCore InvokeHarness API. In its August 6, 2026 account, CSA said an authenticated remote caller could place a tool-use content block in the request’s final message. The event loop dispatched the requested tool without invoking the model to authorize that action; CSA described the consequence as “the model never ran at all.”
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
That makes CoreBreak conceptually different from prompt injection. Prompt-injection defenses, refusal training or instructions telling a model not to use a tool would not necessarily stop a route in which the dispatch layer accepts a tool request without a model turn. The control to examine is whether the dispatch layer verifies the provenance and authorization of every tool call.
Reported severity and managed-service status
CSA reports CVE-2026-18830 with a CVSS v4.0 score of 8.6. CSA also says AWS deployed a fix to the managed service automatically before July 31, 2026, without requiring customer action. Its report does not say that customers must install a patch for the managed API. Teams building or operating agent dispatch systems should still verify that each executed call is tied to a legitimate model response in the correct session.
What to do if you operate these systems
- Check Strands deployments. Inventory the installed
strands-agents-toolsversion and any fork or derivative that implements the affected HTTP tool. Move affected deployments to 0.8.2 or later, and patch derivative code. - Rotate the relevant Strands credentials. Identify credentials configured through
HTTP_REQUEST_TOKEN_CONFIGon affected versions and rotate them as AWS recommends. If you cannot upgrade promptly, remove that credential binding fromhttp_requestconfigurations that process untrusted content and configure any needed proxy out of band. - Constrain AgentCore Harness capabilities. Set
allowedToolsto the tools actually needed for each session, limit downstream identity permissions to the minimum required, and restrict and monitor outbound traffic from harness containers. - Audit dispatch authorization. For agent platforms and integrations, verify that a tool is executed only when a valid model response in the same session authorized it. This is a general control prompted by CoreBreak, not evidence that AWS’s managed API remains vulnerable.
- Layer prompt defenses. AWS Prescriptive Guidance for security in agentic AI recommends automated prompt validation, input sanitization, Bedrock Guardrails, and prompt logging and metrics. These controls can help reduce risk, but AWS advises against relying on prompt defenses alone.
What is known about real-world impact
The cited AWS bulletin and research accounts describe technical attack paths and, for the AgentCore Harness case, a researcher proof of concept. They do not provide a verified count of affected AWS customers, confirmed successful exploitation of customer deployments, or confirmed stolen customer credentials. Treat the findings as reasons to verify configuration, update the affected Strands package and apply the relevant controls—not as proof that a particular account was compromised.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
