AWS, Google, Vercel Patch Agent Tool Bypasses
AWS, Google, and Vercel patched flaws in AI agent infrastructure that allowed attacker-controlled data to invoke agent tools without a model-authorized turn, The Hacker News reported on August 6. The affected components included Amazon Bedrock AgentCore, Google's Python Agent Development Kit, and Vercel AI SDK harness packages. Researchers presented the cross-platform vulnerability pattern, called CoreBreak, at Black Hat USA 2026.
AWS, Google, and Vercel have patched vulnerabilities that could let attacker-controlled or forged instructions reach AI-agent tools without evidence that a language model authorized the invocation. The Hacker News reported that the affected products were Amazon Bedrock AgentCore's InvokeHarness API, Google's Agent Development Kit (ADK) for Python, and Vercel AI SDK harness packages for Codex and OpenCode coding agents.
The findings concern the authorization boundary between an agent model's output and the runtime that dispatches tools. In the affected paths, data formatted like a model-generated tool call could be accepted by the execution layer even when no legitimate model turn had produced it. That bypassed model-context controls, including system prompts, content filters, and other guardrails that would normally participate in the model's decision to use a tool.
Researchers Hedi Ingber and Aviyam Ivgi presented the cross-platform pattern as "CoreBreak" at Black Hat USA 2026 on August 6, according to TechTimes. The researchers' findings covered distinct attack paths rather than one shared bug, and the practical risk depended on the tools and privileges exposed to each agent.
A missing provenance check
In a conventional agent workflow, an SDK sends user input, conversation context, system instructions, and available tool schemas to a model. The model then returns a structured tool call, which the runtime executes. The reported flaws arose where the runtime treated caller-controlled or otherwise untrusted data as though it were the output of that model step.
The Hacker News reported that an attacker did not need to jailbreak the model or persuade it to disregard instructions. Instead, the attacker could target a dispatch or authorization path that accepted a tool-call-shaped payload. This is materially different from prompt injection: the reported weakness is not model behavior, but missing verification of the provenance of a tool invocation.
The attack requirements varied by implementation:
- •For AWS, The Hacker News reported that an authenticated remote user could supply a tool-use content block in the final message of an AgentCore InvokeHarness request.
- •For Google ADK, the reported paths required attacker-controlled session events or user-authored function calls.
- •For Vercel's harness packages, the reported flaws required untrusted code already executing within a Linux sandbox.
The Hacker News also noted that exposure is limited by an agent's existing permissions. An agent without access to sensitive tools or data does not gain new capabilities solely from this authorization bypass. Conversely, the impact is greater where an agent can access privileged APIs, execute code, modify records, retrieve secrets, or perform external actions.
Patches and remaining Strands concern
According to The Hacker News, AWS fixed the vulnerability in its managed AgentCore service. The issue was assigned CVE-2026-18830 and received a CVSS v4.0 score of 8.6. Google addressed the ADK issues in version 2.5.0. Vercel patched @ai-sdk/harness-codex in version 1.0.29 and @ai-sdk/harness-opencode in version 1.0.28.
TechTimes reported that the broader research covered three attack paths across five CVEs. It also reported that AWS did not issue a code fix for a model-skipping path in the open-source Strands Python SDK, despite fixing the managed AgentCore service. Organizations using Strands should therefore review the relevant advisory and their installed SDK version rather than assuming the managed-service remediation covers open-source deployments.
For agent-platform engineers, the findings reinforce an architectural security pattern: a tool runtime should authenticate and validate that a tool request originated from an authorized model turn, rather than relying only on the request's structure. Comparable agent systems typically need controls at both layers, model-side policies to shape intended behavior and runtime-side authorization to enforce who or what may invoke privileged tools.
Key Points
- 1CoreBreak bypasses the model authorization step, allowing tool-call-shaped data to reach runtimes without model guardrails evaluating the request.
- 2AWS, Google, and Vercel issued fixes, but remediation differs by managed service, SDK package, version, and deployment architecture.
- 3Agent systems with privileged tools face greater risk; comparable architectures benefit from runtime provenance checks alongside model-level safeguards.
Scoring Rationale
The vulnerabilities affect a fundamental security boundary in agentic systems: whether a tool invocation actually originated from an authorized model turn. The affected vendors and patch releases make this immediately relevant to teams operating agent runtimes with code execution, data access, or external-action tools.
Sources
Public references used for this report.
Practice with real Ad Tech data
90 SQL & Python problems · 15 industry datasets
250 free problems · No credit card
See all Ad Tech problems
