AWS, Google, and Vercel Agent Infrastructure Flaws Allowed Unauthorized Tool Execution
Critical vulnerabilities in AWS, Google, and Vercel agent infrastructure allowed attackers to trigger tools without model authorization, bypassing security controls.
Security flaws discovered in the agent infrastructure of major cloud providers AWS, Google, and Vercel have exposed systems to unauthorized tool execution. These vulnerabilities, collectively dubbed "CoreBreak" by researchers Hedi Ingber and Aviyam Ivgi of Stealth, allowed attackers to bypass system prompts, content filters, and other guardrails by directly triggering an agent's tools without proper authorization from a generative model.
The affected products include Amazon Bedrock AgentCore's InvokeHarness API, Google's Agent Development Kit (ADK) for Python, and Vercel's AI SDK harness packages for its Codex and OpenCode agents. While the specific attack vectors varied, the common thread was the ability to send instructions that mimicked legitimate model-generated tool calls directly to the execution layer, circumventing the usual authorization steps.
In the case of AWS, a flaw (CVE-2026-18830) in the managed AgentCore's InvokeHarness API allowed an authenticated remote user to insert a tool-use block into a request, leading to direct tool dispatch without model intervention. AWS has since patched this managed service by adding server-side validation. However, a similar model-skipping path remains in the open-source Strands Python code, which AWS considers a customer-managed issue and has addressed through documentation updates rather than a code fix.
Google's ADK for Python (versions prior to 2.5.0) was affected by two distinct vulnerabilities. The first (CVE-2026-18236) allowed an attacker to forge session events to bypass confirmation prompts for sensitive tools. The second flaw in resumable-mode flows permitted user-authored messages containing function_call parts to directly execute registered tools, bypassing the LLM entirely. Google has addressed both issues in ADK 2.5.0.
Vercel's AI SDK harness packages for its Codex and OpenCode agents were also impacted. These flaws required untrusted code to be running within a Linux sandbox, but once inside, attackers could trigger tool execution without model authorization. Vercel has released patches for the affected packages, @ai-sdk/harness-codex in version 1.0.29 and @ai-sdk/harness-opencode in version 1.0.28.
The impact of these vulnerabilities is bounded by the tools an agent is already configured to use. An agent connected to non-sensitive tools would not offer an attacker significant leverage. However, agents with access to critical functions could be misused for unauthorized actions, data exfiltration, or system manipulation.
Researchers presented the CoreBreak pattern at Black Hat USA 2026, highlighting the critical need for robust provenance verification between model decisions and tool execution in AI agent frameworks. The findings underscore the evolving threat landscape for AI systems, where vulnerabilities can emerge not just in the models themselves, but in the surrounding infrastructure that enables their interaction with external tools and services.
While patches and mitigations are now available for the specific products, the discovery serves as a stark reminder for developers and organizations to rigorously audit their AI agent implementations, ensure proper security controls are in place, and stay informed about emerging attack vectors targeting these powerful technologies.