• CVE-2026-115845, AWS MCP Server (Oct 23): the Python validator behind the run_script tool, which runs agent-written scripts with the caller's IAM permissions, had an incomplete blocklist, so a crafted script could run arbitrary code inside the user's own isolated session. AWS fixed it service-side; no customer action is needed.
• CVE-2026-115419, Strands Agents A2A server (Oct 22): the Agent2Agent server component did not isolate conversation state between callers, so one authenticated user could read another caller's history or steer the model for them in multi-tenant setups. Fixed in strands-agents 1.43.0 (Python) and @strands-agents/sdk 1.5.0 (TypeScript). There is no workaround except running one A2A server per user or tenant.

Why it matters: blocklist validators for agent-run code keep failing, and A2A endpoints are a new shared-state surface. If you expose an agent over A2A to more than one user, check that sessions are keyed per caller, not per server.