Strands Agents leaves agent session files open to local attackers

Two security advisories published on 27 October 2026 describe flaws in the default session storage used by Strands Agents, the Python package distributed on PyPI as strands-agents. Both concern the FileSessionManager component, which persists an agent's conversation history and state to disk. According to the advisories, the default configuration exposes that data to any other local user, and in the worse of the two cases lets a local attacker overwrite files belonging to the victim's account.

The first advisory, GHSA-763v-5pjm-fx36, covers a confidentiality problem. By default the session manager writes to /tmp/strands/sessions and leaves permissions to the process umask. On systems using the common umask 022, the advisory says, directories end up as 0755 and the JSON session files as 0644, meaning other local users can read them. The reporter reproduced this on commit dd7b41de38cb, showing a fake secret planted in a session dictionary being readable from the resulting file.

That matters because of what sessions hold. The advisory notes that session storage is meant to persist conversation, history and state, so the files can contain prompts, model output, tool inputs and outputs, intermediate state, and any secrets that pass through the agent. The scenarios it lists are shared developer machines, continuous integration hosts, notebooks, jump boxes and multi-user GPU servers.

The second advisory, GHSA-3w55-933p-8pv5, is more serious. It targets the _write_file method, which writes to a predictable path with a .tmp suffix and then calls os.replace. Because Python's open follows symbolic links, an attacker who gets a symlink in place at that .tmp path first will have the victim's process write JSON into whatever the link points at. The advisory describes an attacker pre-creating a session directory, or watching for new ones with inotify, then pointing session.json.tmp at a file such as ~/.bashrc, .ssh/authorized_keys or a cron file. The result, it says, is arbitrary file overwrite and local privilege escalation, with code execution following at the next shell login. A short proof-of-concept script in the advisory demonstrates the overwrite.

The same advisory flags a second attack path. Session files carry no integrity check such as an HMAC, so the SDK loads whatever it finds. An attacker who writes crafted message files into a session directory can have the agent restore an attacker-controlled conversation history. The advisory says injected messages can instruct the agent to run attacker commands on every future interaction, giving what it calls persistent agent compromise.

Both advisories suggest fixes rather than reporting one. They recommend defaulting to a user-private directory such as ~/.strands/sessions or one under $XDG_DATA_HOME instead of /tmp, or creating /tmp/strands and everything below it with 0700 permissions. For the write itself, the suggestions are to use os.open with the O_NOFOLLOW flag so symlinks are refused, to use tempfile.mkstemp instead of a predictable .tmp suffix, and to write session JSON atomically with 0600 permissions. The advisories also propose checking that an existing storage directory is owned by the current user and is not group or world accessible before writing to it, adding optional HMAC integrity verification, and documenting that callers should set storage_dir explicitly when they need shared storage.