This agent forwards caller-controlled conversation history ('messages' -> Agent(messages=…)) into the Strands Agent without a step that removes 'toolUse' / 'tool_use' content blocks. On strands-agents<=1.55.0 (all released versions; no upstream fix), the event loop's '_has_tool_use_in_latest_message' check (event_loop.py) then skips the model call whenever the latest message already contains a toolUse block and dispatches that tool directly. An attacker who controls the last message can execute a configured tool with attacker-chosen arguments, bypassing the model and every guardrail wrapped around the model call. AWS patched the managed AgentCore InvokeHarness API for CVE-2026-18830 but did not change the open-source SDK.

37    # `event["messages"]` is the whole conversation history supplied by the38    # caller — trusted verbatim, tool_use blocks and all.39    messages = event["messages"]40    agent = Agent(41        system_prompt=SYSTEM_PROMPT,42        tools=[delete_document],43        messages=messages,

- messages = event["messages"]
- agent = Agent(system_prompt=SP, tools=TOOLS, messages=messages)
+ def _strip_tool_use(messages):
+     out = []
+     for m in messages:
+         blocks = [b for b in m.get("content", [])
+                   if "toolUse" not in b and "tool_use" not in b]
+         out.append({**m, "content": blocks})
+     return out
+ 
+ messages = _strip_tool_use(event["messages"])
+ agent = Agent(system_prompt=SP, tools=TOOLS, messages=messages)