Security researchers at Black Hat USA 2026 today revealed a family of vulnerabilities in AI agent infrastructure from Amazon Web Services, Google, and Vercel that allow attackers to bypass the underlying language model and directly invoke tools with no authorization check.
The flaws, collectively dubbed CoreBreak, were presented by Hedi Ingber and Aviyam Ivgi of a stealth startup. In a normal AI agent flow, a software development kit sends a user request along with system prompts and tool definitions to a model. The model decides whether to call a tool and returns a structured instruction. The SDK then executes it. CoreBreak exploits the fact that several agent runtimes never verified that the instruction actually came from a legitimate model turn.
AWS filed CVE-2026-18830 with a CVSS v4.0 score of 8.6 against its Bedrock AgentCore InvokeHarness API. An authenticated remote user could place a tool-use content block in the final message of a request, causing the event loop to dispatch the named tool directly without consulting the model. AWS patched the managed service on July 31 and said no customer action is required.
However, researchers noted that a comparable model-skipping path remains in Strands, the open-source Python framework on which AgentCore harness is built. A code comment reads skip model invocation if the latest message contains ToolUse. AWS told the researchers this behavior falls under its shared-responsibility model and responded with a documentation change rather than a code fix.
Google patched two flaws in its Agent Development Kit for Python, both fixed in ADK 2.5.0 released on July 16. The first, CVE-2026-18236 with a CVSS v4.0 score of 9.3, affected confirmation flows for sensitive tools. An attacker able to inject session events could forge an approval and cause an unauthorized tool to execute. The second flaw affected resumable-mode flows, which accepted user-authored function call parts that could be interpreted as instructions to run registered tools.
Vercel patched its AI SDK harness packages in version 1.0.29 for Codex and 1.0.28 for OpenCode. Its vulnerabilities required untrusted code already running inside a Linux sandbox, meaning malicious code could satisfy security checks and invoke host-exposed tools including secret lookups and cloud API calls without a corresponding model-authorized event.
The discovery highlights a fundamental design challenge in agentic AI: the boundary between untrusted input and tool execution. All three flaws were classified under incorrect authorization. Researchers emphasized that the exposure in each case is bounded by what an agent can already do, meaning an agent wired to no sensitive tools gains an attacker nothing.
Sources: The Hacker News, AWS Security Bulletin
discussion