CoreBreak: AWS, Google, Vercel Agent Tools Skipped Model Checks
Security researchers from Stealth have uncovered a cross-platform vulnerability pattern dubbed “CoreBreak“ that affects agent infrastructure from Amazon Web Services, Google, and Vercel. Presented by co-founders Hedi Ingber and Aviyam Ivgi at Black Hat USA 2026, the flaws allow attackers to forge or inject tool-call instructions that reach an agent's dispatch layer without any model turn authorizing them. Because the model never executes in several of these paths, system prompts, content filters, and other model-level guardrails are completely bypassed, leaving the harness to treat attacker-supplied data as authoritative.
The affected products include Amazon Bedrock AgentCore's InvokeHarness API, Google's Agent Development Kit (ADK) for Python, and Vercel AI SDK harness packages for the Codex and OpenCode coding agents. AWS has patched the managed service and assigned CVE-2026-18830 with a CVSS v4.0 score of 8.6 for the insufficient input validation flaw, which reportedly affected the managed InvokeHarness API before July 31, 2026. Google addressed the issues in ADK 2.5.0, while Vercel patched @ai-sdk/harness-codex in version 1.0.29 and @ai-sdk/harness-opencode in version 1.0.28. However, the researchers caution that the open-source Strands Python code underlying AgentCore retains a comparable model-skipping path that the managed-service fix does not cover.
The attack conditions differ across platforms. AWS's path required an authenticated remote request, Google's variants depended on attacker-controlled session events or user-authored function calls, and Vercel's flaws required untrusted code already running inside a Linux sandbox. Exposure is bounded by each agent's tool scope, meaning an agent wired to no sensitive tools gains an attacker nothing. Developers using these frameworks should verify their deployed versions against the patched releases, audit their agent's tool permissions, and run a SSL/TLS checker to ensure API endpoints are properly secured. For organizations deploying AI agents in production, a thorough review of SDK versions and a port scanner assessment of exposed agent infrastructure can help identify residual attack surface in unpatched instances.