CoreBreak Flaws Let Attackers Trigger AI Agent Tools Without the Model: AWS, Google, Vercel All Affected

TL;DR

Security researchers at Stealth disclosed CoreBreak, a cross-platform vulnerability class in AI agent frameworks from AWS, Google, and Vercel that lets attackers invoke agent tools without a model turn ever authorizing them. Google's ADK flaw earned a CVSS 9.3. If you use Bedrock AgentCore, Google ADK, or Vercel AI SDK harnesses, you need to patch now. The deeper concern: this isn't a model problem. It's an architecture problem nobody was auditing.

What Happened

On August 6, 2026, Hedi Ingber and Aviyam Ivgi, co-founders of security firm Stealth, presented CoreBreak at Black Hat USA. The research uncovered a pattern that spans three major AI agent platforms: an attacker can forge a tool call that reaches the agent's tools directly, bypassing the model entirely.

Think about what that means. The model, the thing you assume is the gatekeeper, never even sees the request. The tool just executes it.

The flaws are not identical across platforms, and the attack conditions differ, but they share the same root cause: the harness layer between model output and tool execution trusts whatever content block arrives, without verifying that a legitimate model turn produced it.

Here is what's affected and what to do about it.

Google ADK (CVE-2026-18236, CVSS 9.3)

Google's Agent Development Kit for Python had two distinct issues that Stealth named Continuation Forgery and the Confirmation Gap. In the first, an attacker could inject content blocks that the framework treated as model-authored tool calls. In the second, the framework failed to check whether a tool call actually came from the model's most recent turn.

ADK versions before 2.5.0 are vulnerable. Google released the fix in ADK 2.5.0. Upgrade now.

This is the most severe of the three because ADK is Python-native and widely used in production agent pipelines. A CVSS of 9.3 means network-exploitable, low complexity, no privileges required.

AWS Bedrock AgentCore (CVE-2026-18830)

Amazon patched the managed Bedrock AgentCore service before July 31, so if you're using the hosted service, you're covered. But there is a catch: the AWS Strands Python SDK, which many developers use to build custom agent harnesses on top of Bedrock, was still unpatched as of August 6, according to TechTimes reporting.

If you built a custom agent harness using the Strands SDK, verify the patch status directly. The managed service fix does not automatically cover custom integrations.

Vercel AI SDK Harnesses (CVE-2026-64650, CVE-2026-64651, CVSS 6.3 each)

The Vercel vulnerabilities affect the harness packages for two coding agents: Codex and OpenCode. In both cases, the harness trusted a process whose command line happened to contain the path of an approved helper script. An attacker who could control that command line could slip unauthorized tool invocations past the harness.

Fix versions:

• @ai-sdk/harness-codex: upgrade to 1.0.29 or later
• @ai-sdk/harness-opencode: upgrade to 1.0.28 or later

Why This Matters Beyond the CVEs

The CoreBreak findings expose a blind spot in how we build AI agent infrastructure.

Most security discussions around AI coding tools focus on two things: the model (does it hallucinate harmful code? does it leak secrets?) and the end-user tool (does Cursor have a CI vulnerability?). The harness, the middleware between "the model said to run this" and "the tool actually ran it," has been largely invisible.

That's the layer CoreBreak attacks.

Consider the architecture of a typical AI coding agent:

The model decides which tool to call. The harness translates that decision into an actual function call with real arguments. If the harness executes tool calls without confirming the model produced them, the model's guardrails become irrelevant. You can have the safest model in the world and it won't matter because the attacker bypasses it entirely.

This is not a theoretical concern. The same week CoreBreak was disclosed, AWS, Google, and Vercel all shipped patches for the same class of flaw. Three different implementations, three different attack vectors, one architectural pattern.

What Developers Should Do

Immediate actions:

1. Upgrade Google ADK to 2.5.0 or later. This is the highest priority. CVSS 9.3 is not something you sit on.

2. Check your Vercel harness versions. If you use @ai-sdk/harness-codex or @ai-sdk/harness-opencode, run npm ls and verify you're on the patched versions.

3. Audit any custom Bedrock integrations. If you built agent tooling on the AWS Strands Python SDK, the managed service patch does not cover you. Confirm patch availability with AWS directly.

Medium-term actions:

1. Add harness-layer testing to your security pipeline. Test that your agent framework rejects tool calls that don't originate from an actual model turn.

2. Assume model guardrails can be bypassed. The CoreBreak pattern isn't specific to these three platforms. The architecture that made it possible (trust the content block, skip model verification) is common. Ask your agent framework vendor: "How do you verify that a tool call came from the model?"

The Bigger Picture

Black Hat 2026 produced two major AI coding security disclosures in the same week. On August 6, Novee Security revealed CI pipeline flaws in Claude Code, Gemini CLI, and Codex. On August 8, Stealth dropped CoreBreak. The Novee findings were about end-user tools. CoreBreak is about the infrastructure those tools are built on.

Together, they paint a picture of an ecosystem where security research is finally catching up to deployment speed. That's good. What's less good is that every layer researchers look at, from the model to the harness to the CI pipeline, has the same problem: assumptions about trust that don't hold.

The fix for CoreBreak is straightforward: upgrade your dependencies. The harder fix is architectural: stop trusting content blocks as if they're equivalent to model decisions. They're not.

Sources: Stealth research presentation at Black Hat USA 2026, The Hacker News, The Cyber Signal, TechTimes, Daily Security Review. Patches confirmed across all three vendors.