Security researchers have uncovered a cross-platform pattern in agent infrastructure from Amazon Web Services, Google, and Vercel that allows untrusted or forged instructions to reach an agent's tools without any verification that a model turn authorized them. In several attack paths, the model never executed, meaning system prompts, content filters, and model-level guardrails were bypassed entirely.

The affected products include Amazon Bedrock AgentCore's InvokeHarness API, Google's Agent Development Kit (ADK) for Python, and Vercel's AI SDK harness packages for the Codex and OpenCode coding agents. AWS has fixed the managed service, Google addressed the issues in ADK 2.5.0, and Vercel patched its harness packages in versions 1.0.29 and 1.0.28 respectively. These are not identical vulnerabilities and do not share the same attack conditions. AWS involved an authenticated remote request, Google's paths required attacker-controlled session events or user-authored function calls, and Vercel's flaws required untrusted code already running inside a Linux sandbox.

The exposure is limited by what each agent can already do, so an agent with no sensitive tools provides no benefit to an attacker. The researchers, Hedi Ingber and Aviyam Ivgi of Stealth, presented the pattern, which they call CoreBreak, at Black Hat USA 2026. In a normal agent flow, the SDK sends the user's request, system prompt, conversation history, and tool definitions to the model. The model decides whether to call a tool and returns a structured instruction. The vulnerable paths did not verify provenance between those steps, treating data shaped like a model-generated tool call as authoritative.

AWS assigned CVE-2026-18830 with a CVSS score of 8.6 to insufficient input validation in the Bedrock AgentCore harness. An authenticated remote user could place a tool-use block in the final message of an InvokeHarness request, and the event loop would dispatch the tool directly without asking the model. AWS says the issue affected the managed API before July 31, 2026, and added server-side validation that rejects caller-supplied tool-use blocks. The fix was applied automatically and requires no customer action.

However, the managed-service fix does not cover a comparable model-skipping path in the open-source Strands Python code, which the researchers say the harness is built on. The current upstream event_loop.py includes a check that, when passed, skips model execution and takes the latest message directly. A comment above that branch reads: "Skip model invocation if the latest message contains ToolUse." The Hacker News confirmed the branch is still present in the repository's main branch as of August 5, 2026. An April pull request warned about this issue but was closed unmerged on June 19. AWS has not published a separate CVE or patch for standalone Strands deployments, and the researchers said AWS told them the behavior falls on the customer's side of its shared-responsibility model.

Google's first flaw, CVE-2026-18236 with a CVSS score of 9.3, affects ADK for Python before 2.5.0. An attacker able to manipulate session history could forge an approval for a sensitive tool, and the confirmation processor did not verify that the target tool belonged to the agent or matched the original call. Google's patch added those checks. A second fix in the same release addressed resumable-mode flows, which accepted user-authored events containing function_call parts that could run registered tools directly. Google now rejects function calls in user-authored messages.

Vercel's findings affect @ai-sdk/harness-codex through version 1.0.28 (CVE-2026-64650) and @ai-sdk/harness-opencode through version 1.0.27 (CVE-2026-64651), both with a CVSS score of 6.3. The harness relay trusted a process when its command line contained the path of an approved helper script. Malicious code already inside the sandbox could invoke host-exposed tools without a model-authorized event. Vercel removed the process-path fallback, and the patched relay accepts a request only when it matches an exact, short-lived, one-time authorization.

Both CVE records contain errors, with the Codex entry naming the OpenCode package and the OpenCode entry's structured data listing a fixed version that contradicts its own text. The researchers said they sent proof-of-concept code to the vendors and have not released it publicly. The advisories do not address whether any path was exploited before patching. The fixes converge on the same control: Google checks confirmations against recorded session data, Vercel binds each request to a one-time authorization tied to an observed model event, and AWS rejects caller-supplied tool-use blocks before they reach the event loop. This is not prompt injection — the model never gets a turn.

Source: The Hackers News