Full research report
AWS, Google, and Vercel Agent Flaws Let Attackers Trigger Tools Without Running the Model
Executive assessment
The CoreBreak findings reveal a systemic design gap in first-generation managed agent infrastructure: SDK runtimes were built to execute tool calls efficiently but did not cryptographically or session-state bind each invocation to a verified model turn. Because the model's output is structured data (a JSON object naming a tool and arguments), any party who can inject equivalently structured data into the execution path — whether through a crafted API request, a forged confirmation event, or a sandbox process impersonating an approved helper — can trigger tool execution without the model's involvement. This matters because all model-level safety controls — system prompts, refusal training, content filters, confirmation workflows — operate before or during model inference, not at tool dispatch time; bypassing the model entirely voids those controls completely. The AWS managed-service fix is transparent to customers, but the corresponding open-source Strands framework retains the shortcut and AWS has framed remediation as a developer responsibility, meaning organisations running self-hosted agentic pipelines built on Strands need to audit their own input-handling code. The Google ADK flaw carries the highest CVSS (9.3, network-reachable, no credentials) because an attacker with the ability to inject or replay session events — a plausible capability in shared-session or multi-user agent deployments — could forge tool confirmations without any foothold in the host environment.
What happened
Researchers Hedi Ingber and Aviyam Ivgi of Stealth identified a class of vulnerability they named CoreBreak across three major agent infrastructure platforms — AWS Bedrock AgentCore, Google's Agent Development Kit (ADK) for Python, and Vercel's AI SDK harness packages — in which agent tool-dispatch paths accepted data structurally resembling a model-generated tool call without verifying that a model turn had actually produced it. In several attack paths the model was never invoked, bypassing system prompts, content filters, and all model-level guardrails. The researchers presented their findings at Black Hat USA 2026 on 5 August; all four CVEs were patched before the presentation, with AWS applying a server-side fix on 31 July 2026, Google shipping ADK 2.5.0 on 16 July 2026, and Vercel publishing harness package patches on 10 July 2026.
Affected scope
Amazon Bedrock AgentCore InvokeHarness API (managed service, prior to 31 July 2026); Google ADK for Python all versions before 2.5.0; Vercel @ai-sdk/harness-codex through 1.0.28 and @ai-sdk/harness-opencode through 1.0.27. Organisations running self-hosted Strands agents (the open-source framework underlying AgentCore) may retain a comparable model-skipping code path that AWS has documented but not patched. The practical exposure in every case is bounded by what tools the agent is configured to access.
Technical assessment
The CoreBreak pattern exploits a trust assumption shared across multiple SDKs: the event loop or tool-dispatch layer treats data shaped like a model-generated tool call as authoritative without cryptographic or session-state proof that the model produced it. For AWS, an authenticated caller could embed a tool-use content block in the final conversation message of an InvokeHarness request, causing the event loop to dispatch the named tool directly. For Google ADK, the confirmation processor did not verify that a confirmed tool belonged to the executing agent, required confirmation, or that its arguments matched the original recorded call event, permitting an attacker who could inject session events to forge approval. For Vercel, the harness relay authorised tool invocations from any process whose command line contained an approved helper script path, allowing untrusted code already executing inside the Linux sandbox to satisfy that check and invoke host-exposed tools without a model-authorised event.
Recommended defensive actions
- Update Google ADK for Python to version 2.5.0 or later immediately; earlier versions are vulnerable to confirmation forgery (CVE-2026-18236, CVSS 9.3).
- Update Vercel @ai-sdk/harness-codex to 1.0.29 or later and @ai-sdk/harness-opencode to 1.0.28 or later to eliminate the process-path authorisation bypass.
- Verify that AWS Bedrock AgentCore managed deployments are using the post-31-July-2026 service; no customer action is required, but confirm via the AWS security bulletin.
- Audit self-hosted Strands deployments to determine whether untrusted callers can supply structured conversation messages or alter stored history; restrict that surface until AWS issues a code-level fix or upstream patch.
- Review all agent tool configurations and apply least-privilege principles: remove access to sensitive tools (secret stores, cloud APIs, deployment pipelines) from agents that process untrusted input.
- Monitor agent audit logs for tool invocations that lack a corresponding model-response event, which may indicate attempted or successful exploitation of similar patterns in other SDKs.
Uncertainties and evidence gaps
- The open-source Strands Python framework retains a code path that skips model invocation when the latest message contains a tool-use block; AWS has published documentation guidance but has not issued a CVE, affected-version range, or code fix for standalone Strands deployments, leaving the remediation boundary unclear.
- The article describes two separate vulnerability paths in Google ADK but was truncated before the second path was fully detailed; it is not confirmed whether both paths are captured under CVE-2026-18236 or whether a separate CVE exists.
- No independent post-presentation exploit code or PoC repository was found; the E:P CVSS evidence flag for CVE-2026-18236 most likely refers to the Black Hat demonstration rather than a public exploit, but this has not been explicitly confirmed.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
No confirmed active exploitation; CVE-2026-18236 carries a CVSS E:P (proof-of-concept evidence) flag, attributed to the Black Hat USA 2026 presentation rather than separately published exploit code; EPSS scores for CVE-2026-64650 and CVE-2026-64651 are negligible (0.00113, 1.6th percentile).
The investigation began with the supplied headline linking four CVEs across three vendors under a unified pattern named CoreBreak, presented at Black Hat USA 2026. Initial parallel searches confirmed the pattern's scope and surfaced vendor advisory and CVE record URLs; fetching the AWS security bulletin and NVD entry for CVE-2026-18830 established that the AWS fix was automatic and server-side. The ThreatInt records for all four CVEs provided confirmed CVSS scores, affected version ranges, and patch references. The Google ADK 2.5.0 release notes corroborated the July 16 ship date, and the Vercel CVE records confirmed the process-path authorisation mechanism. The Strands open-source exposure and the truncated second Google ADK path were identified as the two principal evidence gaps, supported by the article text but not independently confirmed from a second source.
- What is the CoreBreak pattern and which CVEs and products does it affect?Web search for CVE-2026-18236, CVE-2026-18830, CoreBreak, AWS, Google, Vercel, Black Hat USA 2026thehackernews.com ↗
CoreBreak is a cross-platform vulnerability class where agent SDK runtimes dispatch tools without verifying a model turn authorised the call; four CVEs span AWS Bedrock AgentCore, Google ADK, and Vercel AI SDK harness packages; all patched before August 6, 2026.
why Establishes the event, timeline, and scope; confirms the article as the primary public source for researcher attribution and per-CVE details.
- What does the official AWS bulletin say about CVE-2026-18830 — scope, patch mechanism, and required customer action?Fetched AWS security bulletin 2026-073aws.amazon.com ↗
CVE-2026-18830 covers insufficient input validation in InvokeHarness; authenticated remote users could inject tool-use content blocks to bypass model invocation; server-side fix applied automatically on July 31, 2026; no customer action required.
why Primary vendor source confirms patch completeness and eliminates any urgency for AWS managed-service customers while flagging the open question about Strands.
- Does NVD corroborate the CVSS scores and product scope for CVE-2026-18830?Fetched NVD entry for CVE-2026-18830nvd.nist.gov ↗
NVD confirms CVSS v4.0 8.6 (AV:N/AC:L/AT:N/PR:L) and CVSS v3.1 8.1; published August 4, 2026.
why Independent authority source corroborating the AWS bulletin; confirms the authenticated-remote-user requirement and high confidentiality/integrity impact.
- What are the precise details, CVSS score, and fix reference for CVE-2026-18236 in Google ADK?Fetched ThreatInt CVE record for CVE-2026-18236cve.threatint.com ↗
CVSS v4.0 9.3 (network-reachable, no privileges, no user interaction); CWE-863 Incorrect Authorization; affects ADK for Python before 2.5.0; patch is commit c03f333769feaeaa9fe8910fbe95cb9f2d513f54; published July 29, 2026; reported by Aviyam Ivgi.
why Highest-severity CVE in the set; the network-reachable, no-privileges CVSS vector makes this the most urgent patching priority for Google ADK users.
- Does the Google ADK 2.5.0 release confirm the security fix shipped on the stated date?Fetched Google ADK Python v2.5.0 release notes on GitHubgithub.com ↗
Release dated July 16, 2026; security improvements noted including module blocking; cross-user artifact access fixes present; no explicit CVE callout in the release notes.
why Confirms the patch shipped before the public disclosure date; the absence of an explicit CVE mention in release notes is consistent with coordinated disclosure practice and does not undermine the fix.
- What are the Vercel CVE details for the harness-codex and harness-opencode authorization bypasses?Fetched ThreatInt CVE records for CVE-2026-64650 and CVE-2026-64651cve.threatint.com ↗
Both Vercel CVEs carry CVSS v4.0 6.3 (local, no privileges required, high subcategory impact); CWE-863; the relay trusted any process whose command line contained an allowed helper script path; fix removes the fallback entirely and requires exact one-time authorisation tied to a model event; published July 20, 2026.
why Lower CVSS than the AWS and Google CVEs, and requires attacker code already executing in the sandbox; confirms that impact is highest when agents hold sensitive host-exposed tools such as secret stores or deployment APIs.
Research coverage
All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 3 registered sources supplied useful evidence (2 primary, 0 corroborating, 1 contextual and 0 PoC/exploit references). 58 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| NVDcve | ok900 records | Primary evidence1 matched items | Supplied a vendor or government advisory opened and verified during focused research. |
| The Hacker Newsnews | ok14 records | Primary evidence1 matched items | Published the source report used to frame and date the event. |
| FIRST EPSSepss | ok | Context2 matched items | Added exploitation-probability context; EPSS does not itself prove exploitation. |
| AlienVault OTXdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| BleepingComputernews | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CISA Alertsnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| CISA KEVkev | ok1661 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | ok5321 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco Talosnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok264 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok675 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1007 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok16 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok13 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok8 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1588 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP Galaxyresearch | ok12 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Rapid7news | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sigma Rulesresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 8 opened outside the registered collection
Vulnerability & exploitation2
Technical references9
Repository captured from the source article as technical context; not validated as PoC or exploit code.
Repository captured from the source article as technical context; not validated as PoC or exploit code.
Repository captured from the source article as technical context; not validated as PoC or exploit code.
Repository captured from the source article as technical context; not validated as PoC or exploit code.
Repository captured from the source article as technical context; not validated as PoC or exploit code.
Repository captured from the source article as technical context; not validated as PoC or exploit code.
Repository captured from the source article as technical context; not validated as PoC or exploit code.
Repository captured from the source article as technical context; not validated as PoC or exploit code.
Repository captured from the source article as technical context; not validated as PoC or exploit code.
Vendor & gov advisories5
Official AWS bulletin confirming server-side fix applied automatically on July 31, 2026; no customer action required
NVD entry confirming CVSS v4.0 8.6 / CVSS v3.1 8.1 and product scope
CVE record confirming CVSS v4.0 9.3, CWE-863, affected versions pre-2.5.0, and fix commit
CVE record for the process-path authorization bypass in the Codex harness relay; CVSS v4.0 6.3
CVE record for the same class of flaw in the OpenCode harness relay; CVSS v4.0 6.3
Analysis & research2
Primary public write-up covering all four CVEs, the CoreBreak pattern, and the unpatched Strands path; sourced from researcher interviews
Release containing the security fix; confirms July 16, 2026 ship date and scope of changes