The code didn't verify the source. It only checked the shape.
That single sentence summartizes the CoreBreak vulnerability class, a set of three CVEs disclosed in July 2026 that bypass model-level guardrails across AWS Bedrock AgentCore, Google ADK for Python, and Vercel’s AI SDK. The research team, Stealth, didn't discover three separate bugs. They identified a pattern: every time an agent framework assumes that a well-formed tool call must have come from the model, the plumbing layer becomes an open gateway.
Context: The Hype Cycle Meets the Inspection Gap
Over the past year, AI agents have moved from demos to production. DeFi protocols deploy them for treasury management, exchanges use them for trade execution, and enterprises route them through approval workflows. The security narrative has been dominated by prompt injection and model alignment. But CoreBreak shifts the battlefield. The scheduling layer – the software that decides which tools to call and when – treats data as sacred, regardless of origin. As long as the data looks like a tool call, it executes. The model never sees the injection. The audit log never shows the malicious prompt. The damage happens in the silent gap between inspection and execution.
Core: The Geometric Teardown
Three CVEs, one root cause. Let’s trace the bleed through each gateway.
CVE-2026-18830 (AWS Bedrock AgentCore, CVSS 8.6): The InvokeHarness API accepts tool-use content blocks in the final message of a request. An authenticated remote caller can inject these blocks directly. The scheduling layer does not verify that the content block originated from a model turn. The model’s system prompt, alignment training, and refusal policies are all bypassed. The attack surface is not internet-facing, but any authenticated user with access to the Bedrock agent endpoint can escalate to tool execution. Based on my experience auditing TheDAO’s recursive call vulnerability in 2017, I recognize the pattern: a missing check on the source of an instruction, not on the instruction itself. The code didn't fail because it was malicious; it failed because it was too trusting.
CVE-2026-18236 (Google ADK for Python, CVSS 9.3): This one is more insidious. The attacker can manipulate or inject events into the session history to forge human approval for sensitive tool calls. The confirmation handler does not verify the ownership of the tool or the parameter match. The “human-in-the-loop” safety net is a fiction. In crypto, we trust the ledger. Here, the session history is the ledger, and it can be rewritten. History is a Merkle tree, not a narrative – but Google ADK treated it as a narrative that could be edited.
CVE-2026-64650/64651 (Vercel @ai-sdk/harness-codex/opencode, CVSS 6.3): The process path check trusts any process whose command line contains an approved helper script path. A malicious process inside a Linux sandbox can satisfy the check by including the path string. The vulnerability is lower severity, but the principle is identical: the scheduler checks the shape of the path, not the source of the process.
Tracing the bleed through the gateway. The common pattern is the inspection-execution gap. The scheduling layer inspects the format of the data (tool call shape) but not its provenance. The model’s output is assumed to be the only source of well-formed tool calls. That assumption is false. Any authenticated caller, any injected event, any manipulated process can produce the same shape. Model-level defenses cannot help because they are not part of the execution chain. The model never sees the malicious input; it was injected after the model’s turn.
Contrarian: What the Bulls Got Right
Despite the severity, the coordinated disclosure appears to have been responsible. All three vendors had patches ready before the Black Hat presentation. AWS automatically deployed the fix to all Bedrock customers by July 31. Google ADK released v2.5.0. Vercel SDK updated to 1.0.29/1.0.28. The research team did not publish full exploit chains, reducing the risk of immediate weaponization. The cloud security alliance cited the findings, which will accelerate industry standards. In a perverse way, CoreBreak is a success story for responsible disclosure. The bulls would argue that the ecosystem is maturing: bugs are found, fixed, and codified. The automatic repair model of AWS shows that managed platforms can absorb these shocks. The open-source SDKs, while requiring manual updates, have a track record of fast patches.
But I am not buying it. Silence is the loudest bug report. The absence of in-the-wild exploit reports does not mean the absence of exploitation. It means we lack the observability to detect it. By the time we see the damage, the leak has already been running for months. The GuardFall study, which tested 11 AI coding agents and found 10 vulnerable to shell injection, reinforces the point: this is not a one-off. It is a structural assumption baked into the architecture of every modern agent framework.
Takeaway: Accountability Begins at the Plumbing Layer
Precision is the only apology the truth accepts. The industry must now rebuild the scheduling layer to verify the source of every tool call cryptographically or logically. Every execution must be bound to a verified model turn. The humans-in-the-loop must have a tamper-proof approval mechanism. The MCP (Model Context Protocol), if it becomes the standard, must include source authentication from day one. Otherwise, it will propagate the same vulnerability across the entire supply chain.
How many more CoreBreaks are waiting in the plumbing we built on trust? The code didn't fail us – the architects did. Now we must trace the bleed back to the root and fix it, not just patch the branch.
