AWS, Google, and Vercel Agent Flaws

Overview

Security researchers have uncovered critical flaws in agent infrastructures from AWS, Google, and Vercel that allowed attackers to trigger tool execution without any model involvement. This bypass meant that system prompts, content filters, and model‑level guardrails never had a chance to intervene. The cross‑platform pattern, dubbed CoreBreak, was presented at Black Hat USA 2026 by Stealth co‑founders Hedi Ingber and Aviyam Ivgi.

The Core Problem

In a normal agent flow, the model decides whether to call a tool and returns a structured instruction. The SDK then executes it.

• In these vulnerable paths, provenance checks were missing.
• The runtime treated tool‑call‑shaped data as authoritative, even if no model turn had occurred.
• Attackers could bypass the model entirely and reach the dispatch path directly.

Vendor‑Specific Flaws

1. AWS Bedrock AgentCore
   • CVE‑2026‑18830 (CVSS 8.6).
   • An authenticated remote user could inject a tool‑use block in an InvokeHarness request, triggering tool execution without model validation.
   • AWS patched the managed service by rejecting caller‑supplied tool‑use blocks.
   • However, the open‑source Strands Python code still contains a shortcut that skips model invocation if the latest message contains ToolUse.
2. Google ADK for Python
   • CVE‑2026‑18236 (CVSS 9.3).
   • Attackers could forge confirmation events, bypassing sensitive tool checks.
   • Another flaw in resumable mode allowed user‑authored function calls to directly execute tools.
   • Both issues were fixed in ADK 2.5.0 (July 16, 2026).
3. Vercel AI SDK Harness
   • CVE‑2026‑64650 and CVE‑2026‑64651 (CVSS 6.3).
   • Malicious sandbox code could exploit process‑path checks to invoke host‑exposed tools.
   • Fixed in @ai‑sdk/harness‑codex v1.0.29 and @ai‑sdk/harness‑opencode v1.0.28 (July 10, 2026).
   • Vercel also hardened tool‑approval replay paths with HMAC‑signed approvals.

Why It Matters

• These flaws are not prompt injection — the model never runs, so no guardrails apply.
• Exploitation depends on what tools the agent is wired to. If sensitive tools are exposed, attackers gain powerful capabilities.
• The incidents highlight the need for execution‑time authorization, not just reliance on model behavior.

Defensive Guidance

• Patch affected packages:
  • Google ADK ≥ 2.5.0
  • Vercel harness‑codex ≥ 1.0.29
  • Vercel harness‑opencode ≥ 1.0.28
• Reject caller‑authored tool calls: Treat conversation history, resumable events, and tool‑use blocks as untrusted input.
• Authorize at execution time: Bind each tool invocation to the exact model event, tool name, arguments, and session state.
• Reduce inherited authority: Limit agents to only the tools and permissions required for their tasks.

Expert in the Cloud Insight

CoreBreak demonstrates that agent security cannot rely solely on model guardrails. The real control must sit at the execution layer, ensuring that every tool call is tied to a legitimate model event. For enterprises adopting AI agents, the lesson is clear: treat structured tool‑call data as untrusted, enforce execution‑time checks, and minimize agent privileges to reduce risk.