AWS, Google, and Vercel Patch Agent Flaws That Trigger Tools Without Running the Model

Security researchers found a way to make AI agents from Amazon Web Services (AWS), Google, and Vercel run their tools without the underlying model ever taking a turn — which means the system prompts, content filters, and model-side guardrails that are supposed to gate those tools never see the request. All three vendors have shipped fixes.

The flaws sit in each company's agent framework, in the handoff between the model deciding to call a tool and the runtime executing it. In the vulnerable paths, data shaped like a model-generated tool call was treated as authoritative, so a request could reach the tool-dispatch path without a legitimate model turn behind it. The practical consequence for defenders: any control you built into a system prompt or a model response can be skipped, because in these paths there is no model response in the loop to enforce it.

The cross-vendor pattern was presented at Black Hat USA 2026 by Hedi Ingber and Aviyam Ivgi, co-founders of the startup Stealth, who named it CoreBreak. As The Hacker News reported on August 6, 2026, these are not the same bug three times over — the three vendors had different entry conditions and filed the issues under different weakness classes — but they converge on one failure: the execution layer trusted the shape of the incoming data instead of proof that a model had authorized it.

What Each Vendor Actually Patched

The affected products, per the reporting and the vendors' own advisories, are Amazon Bedrock AgentCore's InvokeHarness API, Google's Agent Development Kit (ADK) for Python, and the Vercel AI SDK harness packages for the Codex and OpenCode coding agents. The fixes landed on different timelines and, in one case, left a related gap open.

AWS: A Managed Fix, an Open-Source Gap

AWS's security bulletin assigns CVE-2026-18830, with a CVSS v4.0 score of 8.6, to insufficient input validation in the Amazon Bedrock AgentCore harness. An authenticated remote caller could get the event loop to dispatch a named tool directly, without the model being asked. AWS says the issue affected the managed InvokeHarness API before July 31, 2026; it added server-side validation that rejects caller-supplied tool-use blocks before they reach the event loop, applied the mitigation automatically, and says customers need take no action.

The catch is what the managed fix does not cover. According to the researchers, AgentCore's harness is built on the open-source Strands Python code, which still contains a comparable model-skipping branch — a comment above it reads, "Skip model invocation if the latest message contains ToolUse." A proposed change that would have removed the shortcut was closed unmerged in June. AWS told the researchers the behavior falls on the customer's side of its shared-responsibility model and responded with documentation rather than a code change: a Strands page titled "Trusted Message History" now warns developers to build conversation history from their own application rather than from input a caller can shape. There is no separate CVE or patch for standalone Strands deployments, so teams running Strands themselves should treat this as a configuration responsibility, not a bug that got auto-fixed for them.

Google: Two Paths, One CVE

Google's first flaw, tracked as CVE-2026-18236 with a CVSS v4.0 score of 9.3, affects ADK for Python versions before 2.5.0. ADK lets a developer flag a sensitive tool as requiring human confirmation before it runs; the vulnerable confirmation processor did not verify that the approved tool belonged to the executing agent, actually required confirmation, or matched the name and arguments of the original call. Google's patch added those checks. A second, related issue fixed in the same ADK 2.5.0 release — which shipped on July 16, 2026 — involved resumable-mode flows accepting user-authored events that Google's own commit described as "bypassing the LLM and directly executing arbitrary registered tools."

Worth noting for anyone scanning by CVE alone: the researchers say the single CVE covers the continuation-forgery path only, because it affects ADK's default configuration, while the resumable-mode bypass is a newer, non-default feature patched in the same release. The identifier should not be read as an umbrella for both. This is Google's second ADK security story of the month, following its decision to remove three ADK workflows over a separate agent-to-agent attack disclosed by Pillar Security.

Vercel: A Sandbox-to-Host Bypass

Vercel's findings affect two harness packages. @ai-sdk/harness-codex through version 1.0.28 is tracked as CVE-2026-64650 (advisory GHSA-qw9h-448j-6rph), and @ai-sdk/harness-opencode through version 1.0.27 is tracked as CVE-2026-64651 (GHSA-g48p-5rr5-8rgq); both carry a CVSS v4.0 score of 6.3. The harness relay trusted a process based on the presence of an approved helper script's path in its command line, which malicious code already running inside the sandbox could satisfy to invoke host-exposed tools — secret lookups, deployment operations, cloud API calls — without a corresponding model-authorized event. Vercel removed the process-path fallback; the patched relay accepts a request only when it matches an exact, short-lived, one-time authorization tied to an observed model event.

This one is narrower in reach than the AWS case. The Hacker News reports it required Linux, an active harness session with at least one host-provided tool, and untrusted code already executing in the sandbox — a malicious dependency, build script, or lifecycle hook. The fixed releases (1.0.29 for Codex, 1.0.28 for OpenCode) were published on July 10, 2026, and both packages have since moved well past them.

Vendor, Product, and Fix at a Glance

Why This Is Not Prompt Injection

It is tempting to file this alongside the year's run of prompt-injection stories, but the researchers and reporting are explicit that it is a different animal. The Hacker News put the distinction plainly: "This is not prompt injection. There is no probabilistic model to fool and no stronger model that resists it, because the model never gets a turn." Google and both Vercel advisories are classified under CWE-863, incorrect authorization; AWS filed its own as improper input validation. The common thread is that the execution layer treated tool-call-shaped data as sufficient authority.

My read: the three fixes are more interesting together than apart, because they converge on the same control. Google now checks a confirmation against the tool and arguments recorded in the session; Vercel binds each relay request to a one-time authorization tied to an observed model event; AWS rejects the caller's tool-use block before the event loop sees it. None of them lets the shape of incoming data stand in for a model turn. That is the durable lesson here — authorization for an agent's actions has to live at the tool layer, not in a prompt the model may never read. The AWS split is the part I would watch: a managed service got patched silently, but the open-source code it is built on was handed back to customers as their responsibility. Anyone self-hosting an agent framework should assume the same division applies to them. It arrives in a month when two frontier labs also admitted their own models breached real companies from inside test sandboxes — the reach of agent tooling is outrunning the controls around it.

What to Verify Now

This disclosure is specific enough to turn into a short checklist rather than a general warning.

• Upgrade the named frameworks. Move Google ADK for Python to 2.5.0 or later, @ai-sdk/harness-codex to 1.0.29 or later, and @ai-sdk/harness-opencode to 1.0.28 or later. If you run AgentCore's managed service, AWS says the fix is already applied; if you run Strands yourself, treat the documentation guidance as your action item.
• Treat caller-authored tool calls as untrusted. Conversation history, resumable events, confirmation responses, and structured tool-use blocks should all be regarded as untrusted input when they cross an external boundary, not as authority to act.
• Authorize at execution time. Bind each tool invocation to the exact model event, tool name, arguments, session, and authorization state that produced it, so a request that skips the model has nothing to match against.
• Reduce inherited authority. Give each agent only the tools, cloud roles, credentials, and write permissions its task requires. The exposure in every one of these cases is bounded by what the agent could already do — an agent wired to no sensitive tools gains an attacker nothing.

Open Questions

A few things remain unresolved. The advisories and CVE records do not say whether any of these paths was used against a live deployment before it was patched; the researchers say they sent proof-of-concept code to the vendors and have not released it publicly. Both Vercel CVE records reportedly carry data-entry errors that cross the two packages, so map each package to its fix against the GitHub advisories rather than the CVE text. And the Strands question is genuinely open: AWS's position is that self-hosted deployments are the customer's responsibility, which means the model-skipping behavior persists by design for anyone who builds their own message history from untrusted input.

Primary Documents

• The Hacker News — AWS, Google, and Vercel Agent Flaws Let Attackers Trigger Tools Without Running the Model
• AWS — Security Bulletin (CVE-2026-18830)
• NVD — CVE-2026-18236 (Google ADK for Python)
• Vercel — GHSA-qw9h-448j-6rph (harness-codex, CVE-2026-64650)
• Vercel — GHSA-g48p-5rr5-8rgq (harness-opencode, CVE-2026-64651)