CoreBreak: AI Agent Tools Fire Without the Model in AWS, Google and Vercel SDKs

Daniel Reyes Principal Engineer (AI/ML), YuSMP Group · LLM systems, agents and AI tooling for US and EU products

The short answer

What CoreBreak actually does

In the normal flow of an AI agent, the model receives a user request, reasons about it, and returns a structured response that may include tool calls. The agent harness reads those tool calls and executes registered tools — reading files, calling APIs, writing records. CoreBreak demonstrates that in the affected AWS, Google and Vercel implementations, the dispatch step could be reached by an attacker without the model ever running.

Teams building products on AI agent development foundations using AWS Bedrock, Google ADK, or Vercel AI SDK should treat this as an immediate patch action. The researchers' central insight is that the execution layer verified the shape of a tool call — whether it looked like a model-authorized instruction — but not its provenance: whether a legitimate, verified model inference had actually produced it.

The researchers named the pattern CoreBreak because it breaks the core authorization contract between the model and the tools it is allowed to invoke. An attacker did not have to persuade the model to act against its instructions. The attacker simply reached the dispatch path without a model turn at all.

The three vendors and five CVEs

AWS — CVE-2026-18830, CVSS v4.0 8.6

The flaw resided in the InvokeHarness API of Amazon Bedrock AgentCore. An authenticated remote user could inject tool-use blocks into the final message of a harness invocation request. The harness dispatched the tool without a model turn, meaning any registered tool — including those with write access to databases or external services — could be invoked directly by an attacker who held a valid API credential.

AWS fixed the managed service server-side on July 31, 2026. No client-side update is required for teams using Bedrock AgentCore through the standard managed API. However, teams running the AWS Strands Python SDK to build custom harnesses should audit their pinned version independently, as reporting at time of disclosure indicated the SDK had not received the same remediation.

Google — CVE-2026-18236, CVSS v4.0 9.3

Google ADK for Python carried two separate vulnerable paths, both fixed in ADK 2.5.0 released July 16. The first path involved forged confirmation-approval events that could resume an agent session and authorize tool execution without a genuine model turn. The second, specific to resumable-mode flows, allowed user-authored messages containing function-call parts to be interpreted as model-authorized instructions to execute registered tools. Google's fix explicitly rejects function calls embedded in user-authored messages and binds approval events to verified model turns.

The resumable-mode path is particularly relevant for long-running agent workflows — a common pattern in data engineering, document processing and multi-step business automation pipelines.

Vercel — CVE-2026-64650 and CVE-2026-64651, CVSS v4.0 6.3 each

Two Vercel AI SDK harness packages were affected. @ai-sdk/harness-codex through version 1.0.28 (patched in 1.0.29) and @ai-sdk/harness-opencode through version 1.0.27 (patched in 1.0.28) both allowed untrusted code running inside a Linux sandbox to exploit process-path trust checks to invoke host tools without model authorization. The lower CVSS scores reflect the narrower attack surface — exploitation requires code already executing inside the sandbox — but teams running AI coding agents in environments where user-supplied code executes within the sandbox should treat this as a priority update.

Why this is different from prompt injection

Prompt injection attacks work by persuading the model to act against its instructions — they require the LLM to process malicious content and make a decision to comply. CoreBreak bypasses the model entirely. The attacker does not need to craft a clever prompt or hope the model will follow injected instructions. The model simply never runs.

This makes CoreBreak structurally different from the Check Point Research findings disclosed at the same Black Hat 2026 event, which focused on classic software vulnerabilities — deserialization, SSRF, path traversal — inside popular open-source agent frameworks like LangChain, LangGraph, and CrewAI. Both classes of risk are real. But they operate at different layers and require different mitigations. Patching your LLM guardrails or improving your system prompt does nothing against CoreBreak-class flaws. The fix has to live at the harness level: execution-time authorization bound to verified model events.

What it means for US & EU software teams

Coverage is broad. AWS Bedrock AgentCore, Google ADK and Vercel AI SDK collectively cover a large share of production AI agent deployments in 2026. If your team shipped an agent to production in the last twelve months, there is a real probability it ran on one of these foundations during the vulnerability window before patches shipped in July.

The AWS managed service patched silently. AWS fixed AgentCore on July 31 without requiring client action on the managed service. This is correct behavior for a cloud-managed runtime — but it also means retrospective forensics are harder. If you need to produce compliance evidence that your agents were not exposed, you will need to reconstruct this from your own AgentCore call logs rather than from a client-side patch timestamp.

The Strands Python SDK may have a gap. Reporting at the time of Black Hat disclosure indicated the AWS Strands Python SDK had not received the same remediation as the managed service. Teams that use Strands to build custom harnesses should verify their SDK version against current AWS security bulletins before deploying or continuing production workloads.

Google's patch was available three weeks before public disclosure. ADK 2.5.0 shipped July 16. If your team is on a later version, you were already protected before Ingber and Ivgi presented at Black Hat. If you are pinned to an older release — a common situation in Python environments where requirements.txt pins get stale — update now.

EU compliance implications. For teams operating under GDPR or DORA, a pre-patch CoreBreak exploitation scenario involving agent access to customer records or financial system data would constitute a personal data breach requiring 72-hour DPA notification. NIS2 entities running AI agent infrastructure should treat these CVEs as a prompt to formally document AI component patch management in their security management systems and, where applicable, record the patching evidence as part of their technical security controls inventory.

The structural lesson. As cloud vendors productize AI agent runtimes, those runtimes become security-critical infrastructure analogous to API gateways or identity providers. The tool dispatch layer needs the same authorization rigor: verify not just the shape of the instruction, but its provenance — whether a legitimate, verified model turn produced it. Vendors are now implementing exactly this, but the incident is a signal that agent runtime security has not historically received the same hardening attention as traditional API infrastructure.

What to do now

For FinTech and HealthTech teams, add a structured review of agent tool registrations to the remediation process: map which tools each harness can invoke, what databases or external systems those tools reach, and confirm that no unintended tool execution occurred during the vulnerability window.

FAQ