The environment tool in the open-source strands-agents-tools package lets an agent list, read, set and delete environment variables, and masks secret-looking values by default. The masking switch was part of the tool schema, so the model could set it. Content the agent was asked to process could instruct the model to call the tool with masking off, returning cloud credentials and API keys in cleartext without asking the operator.

• Affected: versions 0.1.0 up to 0.8.5. Fixed: 0.8.6, where only the operator controls masking; the environment tool is now deprecated.
• AWS recommends: upgrade, patch any forks, and rotate credentials that were in the environment of agents that loaded this tool. If you cannot upgrade, remove the tool, avoid long-lived keys in agent process environments, and restrict agent egress to trusted endpoints.

Take: a "safe by default" flag that the model can flip is not a control. This is the same lesson as the Agno PandasTools bug earlier today; see the tip on model-controlled tool parameters.