CoreBreak bug hit AWS, Google, Vercel agents
Researchers found flaws in AWS Bedrock AgentCore, Google ADK, and Vercel's AI SDK harnesses that let forged tool calls run without the model ever calling them.
Security researchers Hedi Ingber and Aviyam Ivgi, co-founders of the startup Stealth, disclosed a cross-platform pattern called CoreBreak at Black Hat USA this week: a way to trigger an AI agent’s tools without the underlying model ever running. A healthy agent loop only executes a tool after the model itself chooses to call it and hands back a structured request naming that tool. The flawed code paths never confirmed that a given request actually traced back to a real model turn, so a runtime that received data merely shaped like a model-generated tool call treated it as authoritative.
Three vendors were affected. Amazon Bedrock AgentCore’s InvokeHarness API carries CVE-2026-18830 (CVSS 8.6), reachable by an authenticated remote request; AWS fixed it in the managed service on July 31. Google’s Agent Development Kit for Python carries CVE-2026-18236 (CVSS 9.3), the most severe of the set, requiring an attacker-controlled session event or user-authored function call; Google shipped the fix in ADK 2.5.0 on July 16. Vercel AI SDK’s harness packages for Codex and OpenCode coding agents carry CVE-2026-64650 and CVE-2026-64651 (CVSS 6.3 each), which required untrusted code already running inside a sandbox; Vercel patched harness-codex v1.0.29 and harness-opencode v1.0.28 on July 10.
The researchers put it plainly:
The model never ran at all, so system prompts, content filters, and model-level guardrails never got a chance to intervene.
What it means for you
None of this required tricking a model into misbehaving, which is the failure mode most agent-security advice targets. It bypassed the model completely by attacking the layer between “the model decided” and “the tool ran.” If you built on Bedrock AgentCore, Google ADK, or Vercel’s Codex/OpenCode harnesses, confirm you are past the July patch dates above. More broadly, this is the same class of trust-boundary problem covered in securing your MCP integrations: verify provenance at every hop where a runtime decides to execute something, not just at the model’s output. It also sits next to this summer’s run of agentic cyber-eval incidents at Anthropic, OpenAI, and now Meta: different failure mode, same lesson that an agent’s environment should never be trusted by default.