Security flaws in agent infrastructure from Amazon Web Services (AWS), Google, and Vercel let untrusted or forged instructions reach an agent’s tools with no check that a model turn had authorized them.
In several of the attack paths, the model never ran at all, so system prompts, content filters, and model-level guardrails never got a chance to intervene.
The affected products include Amazon Bedrock AgentCore’s InvokeHarness API, Google’s Agent Development Kit (ADK) for Python, and the Vercel AI SDK harness packages for the Codex and OpenCode coding agents. AWS has fixed the managed service, Google addressed the issues in ADK 2.5.0, and Vercel patched @ai-sdk/harness-codex in version 1.0.29 and @ai-sdk/harness-opencode in version 1.0.28.
These are not identical vulnerabilities and do not share the same attack conditions. AWS involved an authenticated remote request, Google’s paths required attacker-controlled session events or user-authored function calls, and Vercel’s flaws required untrusted code already running inside a Linux sandbox.
The exposure is bounded by what each agent can already do, so an agent wired to no sensitive tools gains an attacker nothing.
The Missing Proof Behind a Tool Call
Hedi Ingber and Aviyam Ivgi, co-founders of Stealth, today presented the cross-platform pattern, which they call CoreBreak, at Black Hat USA 2026. Both answered questions from The Hacker News by email.
In a normal agent flow, the software development kit sends the user’s request, system prompt, conversation history, and available tool definitions to the model. The model decides whether to call a tool and returns a structured instruction containing the tool name and arguments. The SDK then executes it.
The vulnerable paths did not verify provenance between those last two steps. The runtime received data shaped like a model-generated tool call and treated it as authoritative.
An attacker did not have to persuade the model to break its rules; the attacker could reach the dispatch or authorization path without a legitimate model turn.
AWS Fixed AgentCore, Strands Retains the Resume Path
AWS’s security bulletin assigns CVE-2026-18830, with a CVSS v4.0 score of 8.6, to insufficient input validation in the Amazon Bedrock AgentCore harness.
An authenticated remote user could place a tool-use content block in the final message of an InvokeHarness request. The event loop could then dispatch the named tool directly without asking the model.
AWS says the issue affected the managed InvokeHarness API before July 31, 2026. It added server-side validation that rejects caller-supplied tool-use blocks before they reach the event loop. The mitigation was applied automatically and does not require customer action.
The managed-service fix does not cover a comparable model-skipping path in the open-source Strands Python code, which the researchers say AgentCore’s harness is built on. The current upstream event_loop.py calls a helper named _has_tool_use_in_latest_message, and when that check passes, the event loop sets the stop reason to tool_use, takes the latest message directly, and skips model execution.
A comment above that branch reads: “Skip model invocation if the latest message contains ToolUse.” The Hacker News confirmed the branch is still present in the repository’s main branch as of August 5, 2026.
Immediately above the check sits a narrower branch that restores a tool-use message the agent stored before an interrupt, rather than taking whatever sits in the latest message.
An April pull request warned that externally injected toolUse blocks could reach tool execution without model invocation. The proposed change would have removed the shortcut, but it was closed unmerged on June 19.
The presence of the shortcut does not make every Strands application remotely exploitable. Exposure depends on whether an application permits untrusted callers to submit structured conversation messages, alter stored history, or otherwise place a toolUse block in the position consumed by the event loop.
AWS has not published a separate CVE, affected-version range, or patch notice for standalone Strands deployments. Ingber and Ivgi said AWS told them the behavior falls on the customer’s side of its shared-responsibility model, and that the company responded with a documentation change rather than a code fix.
AWS documented the behavior instead. A Strands page titled Trusted Message History, filed under Safety and Security, tells developers that a tool-call block as the most recent message causes the agent to run that tool directly on its next invocation with no model call in between, and that the block’s author chooses the tool and its arguments outright. It instructs developers to build message history from their own application rather than from input a caller can shape.
Two Separate Paths in Google’s ADK
The first Google flaw, tracked as CVE-2026-18236 with a CVSS v4.0 score of 9.3, affects ADK for Python versions before 2.5.0. ADK lets a developer flag a sensitive tool as requiring confirmation, which holds the call until a person approves it. An attacker able to manipulate or inject events into an agent’s session history could forge that approval and cause an unauthorized tool to execute.
The confirmation processor did not verify that the target tool belonged to the executing agent, that the tool actually required confirmation, or that its name and arguments matched the original call recorded in the session. Google’s patch added those checks.
Google shipped a second, related fix in the same ADK 2.5.0 release, which went out on July 16, 2026. Resumable-mode flows accepted user-authored events containing function_call parts, which could be interpreted as instructions to run registered tools
Google now rejects function calls in user-authored messages, preventing what its commit described as bypassing the LLM and directly executing arbitrary registered tools.
The release notes list the resumable-mode bypass separately from the continuation-forgery fix. The researchers said both findings were theirs, and that Google issued a CVE for continuation forgery because it affects the default configuration, while resumable mode is a newer, non-default feature.
The public record for CVE-2026-18236 covers the continuation-forgery path only, and should not be used as an umbrella identifier for both issues.
Vercel’s Relay Trusted the Process Path
Vercel’s findings affect @ai-sdk/harness-codex through version 1.0.28, tracked as CVE-2026-64650, and @ai-sdk/harness-opencode through version 1.0.27, tracked as CVE-2026-64651. Both carry a CVSS v4.0 score of 6.3.
The harness relay trusted a process when its command line contained the path of an approved helper script, host-tool-mcp.mjs in the OpenCode case and the Codex command line shim in the other.
Malicious code already running inside the sandbox could satisfy that check and invoke host-exposed tools, including secret lookups, deployment operations, and cloud API calls, without a corresponding model-authorized event.
This was a local sandbox-to-host authorization bypass, a different path from the remote request AWS fixed. Exploitation required Linux, an active harness session with at least one host-provided tool, and untrusted code already executing in the sandbox, such as a malicious dependency, build script, or lifecycle hook.
Vercel removed the process-path fallback. The patched relay accepts a request only when it matches an exact, short-lived, one-time authorization for the tool name and input observed in a model event.
The Hacker News confirmed via the npm registry that both fixed releases were published on July 10, 2026. Both packages have since moved well past them, to 1.0.60 and 1.0.59 as of August 5, 2026.
A separate Vercel fix landed a month earlier. Pull request 15947, merged June 10, hardened the SDK’s tool-approval replay path against client-forged approvals, and its acknowledgement credits Claude, Anthropic’s AI assistant, along with Anthropic’s security team.
Vercel described the resulting controls, opt-in HMAC-signed tool approvals and revalidation of tool inputs before execution resumes, in its AI SDK 7 release notes. Ingber and Ivgi attribute that finding to Anthropic’s Mythos, disclosed under Project Glasswing, rather than to their own team.
Both CVE records carry errors. The Codex entry names the OpenCode package in its description, and the OpenCode entry’s structured data lists a fixed version that its own text contradicts. The Hacker News mapped each package to its CVE against the two GitHub advisories, which state the affected and patched versions directly.
The Control Has to Sit at the Tool
As of this writing, the advisories and CVE records behind these fixes do not address whether any of the paths was used against a live deployment before it was patched.
Ingber and Ivgi said they sent proof-of-concept code to the affected vendors and have not released it publicly.
The execution layer in each case treated tool-call-shaped data as sufficient authority. Google’s record and both Vercel advisories are classified under CWE-863, incorrect authorization, and AWS filed its own as improper input validation.
Any safeguard implemented only in a system prompt or model response disappears when a caller can reach the dispatch path without a legitimate model turn.
The three remedies converge on the same control. Google checks a confirmation against the tool and arguments recorded in the session, Vercel binds each relay request to a one-time authorization tied to an observed model event, and AWS rejects the caller’s tool-use block before the event loop sees it. None of them lets the shape of the incoming data stand in for a model turn.
- Patch the affected packages: Upgrade Google ADK for Python to version 2.5.0 or later, @ai-sdk/harness-codex to 1.0.29 or later, and @ai-sdk/harness-opencode to 1.0.28 or later.
- Reject caller-authored tool calls: Treat conversation history, resumable events, confirmation responses, and structured tool-use blocks as untrusted input when they cross an external boundary.
- Authorize at execution time: Bind each tool invocation to the exact model event, tool name, arguments, session, and authorization state that produced it.
- Reduce inherited authority: Give each agent only the tools, cloud roles, credentials, and write permissions required for its task.
This is not prompt injection. There is no probabilistic model to fool and no stronger model that resists it, because the model never gets a turn.
