Tip: if the model can set a tool parameter, an attacker who reaches the model can set it too. Keep masking, sandbox and approval flags out of tool schemas, and never pass tool arguments through a shell
Two fresh examples. AWS's Strands environment tool let the model pass a "mask secrets" switch, so a prompt injection could turn masking off and read cloud keys (CVE-2026-115415, fixed in 0.8.6). The ai-sdlc MCP server put the model-supplied repo value into a shell string for gh issue view, so metacharacters ran commands (CVE-2026-117558, fixed in commit 717d7ecf by spawning gh with an argument array). Review your own tools: (1) list every parameter in each tool schema and ask "what happens if an attacker picks this value?"; (2) move security settings (masking, sandbox on/off, allowed paths, approval) into operator config the model cannot change; (3) use argument arrays and strict schemas (for example owner/name regex) instead of string commands; (4) run tools as a low-privilege user without long-lived credentials in the environment.
Sources: AWS Security Bulletin 2026-154-AWS: CVE-2026-115415, secret masking bypass in the environment tool in Strands Agents Tools (Oct 28) · NVD: CVE-2026-117558, ai-sdlc plugin MCP server command injection via repo argument (Oct 27) · ai-sdlc fix commit 717d7ecf: spawn gh without a shell