AWS, Google, and Vercel Agent Flaws Let Attackers Trigger Tools Without Running the Model

Security researchers Hedi Ingber and Aviyam Ivgi (co-founders of Stealth) identified a cross-platform attack pattern called 'CoreBreak' affecting AI agent SDKs from AWS, Google, and Vercel. The core issue is that the vulnerable agent runtimes did not verify provenance between a model-generated tool call and the execution of that tool. Attackers could reach the dispatch or authorization path without a legitimate model turn, bypassing system prompts, content filters, and model-level guardrails entirely.

AWS (CVE-2026-18830, CVSS 8.6): The Amazon Bedrock AgentCore InvokeHarness API allowed an authenticated remote user to place a tool-use content block in the final message of an InvokeHarness request. The event loop would then dispatch the named tool directly without invoking the model. AWS patched the managed service with server-side validation rejecting caller-supplied tool-use blocks. The open-source Strands Python SDK retains a comparable path via the _has_tool_use_in_latest_message helper in event_loop.py, which when true, sets stop reason to tool_use and skips model execution. AWS responded with documentation (a 'Trusted Message History' page) rather than a code fix for Strands.

Google ADK (CVE-2026-18236, CVSS 9.3): Two separate flaws in ADK for Python before 2.5.0. First, the confirmation processor for sensitive tools requiring human approval did not verify that the target tool belonged to the executing agent, that it actually required confirmation, or that the name/arguments matched the original call in the session — allowing forged approvals via manipulated session history. Second, resumable-mode flows accepted user-authored events containing function_call parts, which could be interpreted as instructions to run registered tools, bypassing the LLM entirely. Google patched both in ADK 2.5.0 (July 16, 2026).

Vercel (CVE-2026-64650, CVE-2026-64651, CVSS 6.3): The harness relay for @ai-sdk/harness-codex and @ai-sdk/harness-opencode trusted a process if its command line contained the path of an approved helper script (host-tool-mcp.mjs for OpenCode, Codex command line shim for the other). Malicious code already running inside a Linux sandbox could satisfy this check and invoke host-exposed tools (secret lookups, deployment operations, cloud API calls) without a model-authorized event. Exploitation required Linux, an active harness session with at least one host-provided tool, and untrusted code in the sandbox (e.g., malicious dependency, build script, lifecycle hook). Vercel patched by removing the process-path fallback and requiring exact, short-lived, one-time authorization tied to a specific model event. Presented at Black Hat USA 2026.