AWS, Google, and Vercel Patch Agent Flaws Allowing Tool Execution Without Model Authorization

Security researchers have uncovered a class of vulnerabilities in agent infrastructure from Amazon Web Services (AWS), Google, and Vercel that allow attackers to trigger agent tools without the AI model ever running. The flaws, collectively dubbed ‘CoreBreak’ by researchers Hedi Ingber and Aviyam Ivgi of Stealth, were presented at Black Hat USA 2026.

The affected products include Amazon Bedrock AgentCore’s InvokeHarness API, Google’s Agent Development Kit (ADK) for Python, and Vercel AI SDK harness packages for Codex and OpenCode coding agents. In each case, the runtime accepted data shaped like a model-generated tool call without verifying its provenance, allowing attackers to bypass model-level guardrails and directly execute tools.

AWS assigned CVE-2026-18830 (CVSS 8.6) to the AgentCore flaw, which allowed authenticated remote users to inject tool-use blocks that bypassed model invocation. The managed service was fixed automatically, but the open-source Strands code remains vulnerable. Google’s CVE-2026-18236 (CVSS 9.3) affects ADK for Python before version 2.5.0, allowing attackers to forge confirmations for sensitive tools. Vercel’s flaws, CVE-2026-64650 and CVE-2026-64651 (both CVSS 6.3), affect the Codex and OpenCode harnesses, enabling sandboxed code to invoke host-exposed tools.

All vendors have released patches, and the researchers have not publicly released proof-of-concept code. The vulnerabilities highlight the need for strict authorization at the execution layer, rather than relying on model-level safeguards.