Researchers Hedi Ingber and Aviyam Ivgi of the security firm Stealth disclosed “CoreBreak,” a cross-platform pattern in which untrusted or forged instructions reach an agent’s tools with no check that a model turn authorized them. Disclosed at Black Hat USA 2026, the finding covers distinct flaws in Amazon Bedrock AgentCore, Google ADK for Python, and the Vercel AI SDK harnesses, all of which were already patched by their vendors.
How CoreBreak Lets Tools Run Without a Model Turn
The pattern is not prompt injection: as Stealth put it, “there is no probabilistic model to fool” because in several paths the model never runs at all. When a model turn never executes, system prompts, content filters, and model guardrails never intervene, so a forged tool-call-shaped request can reach a connected tool directly.
The AWS Bedrock AgentCore Input Validation Flaw
In Amazon Bedrock AgentCore, CVE-2026-18830 (CVSS 4.0 base score 8.6), insufficient input validation let an authenticated remote user place a tool-use content block in the final message of an InvokeHarness request, and the event loop dispatched the named tool without asking the model. AWS added server-side validation before the end of last month and applied the fix automatically, but the managed change does not cover the open-source Strands Python code AgentCore is built on. The _has_tool_use_in_latest_message shortcut that skips a model invocation is still present on the main branch, and a pull request that would have removed it was closed unmerged; AWS treats standalone Strands deployments as the customer’s responsibility.
The Google ADK Continuation Forgery and Confirmation Gap
In Google ADK for Python, CVE-2026-18236 (CVSS 4.0 base score 9.3) is a continuation forgery: an attacker able to inject events into an agent’s session history could forge confirmation of a sensitive tool, and the confirmation processor did not verify target-tool ownership, whether confirmation was required, or that the name and arguments matched the recorded call. A related fix in ADK version 2.5.0 rejected user-authored function-call parts in resumable mode.
The Vercel Harness Trust by Process Path
In the Vercel AI SDK, CVE-2026-64650 (Codex harness) and CVE-2026-64651 (OpenCode harness), each rated 6.3, the harness relay trusted a process whose command line contained the path of an approved helper script. That let untrusted code already running in the Linux sandbox invoke host-exposed tools such as secret lookups, deployment operations, and cloud API calls without a model-authorized event. Vercel removed the process-path fallback and bound each request to a one-time authorization tied to an observed model event, with fixed releases published before the Black Hat disclosure. A separate, earlier Vercel fix hardened tool-approval replay with opt-in HMAC-signed approvals.
Why the CoreBreak Flaws Are Authorization Failures, Not Prompt Injection
The CoreBreak findings classify these issues under CWE-863, incorrect authorization, with the exception of the AWS validation flaw. They are distinct from prompt injection because the model plays no role in the decision. Stealth found no evidence any path was exploited in the wild before the vendors patched. The researcher response centers on treating caller-authored tool calls as untrusted by default, binding each invocation to the exact model event, and granting agents minimal privilege.
What CoreBreak Means for Agent-Driven Cloud Workflows
Agent frameworks that treat tool-call-shaped data as sufficient authority let attackers execute tools with no model authorization, defeating every model-level guardrail. That is especially consequential for agent-driven DevOps and cloud workflows, where tools control the ability to read secrets, deploy, and call cloud APIs. The CoreBreak results put agent security on the Black Hat agenda, and for platform teams the sequence of disclosures across AgentCore, ADK, and the AI SDK harnesses is a cumulative warning to harden the framework’s authorization layer independently of the model’s own safety controls.
