Threat · curated 6 Aug 2026
AWS, Google, and Vercel Agent Flaws Let Attackers Trigger Tools Without Running the Model
First reported · updated · 2 reports thehackernews.com
Coverage timeline
Why it matters
These agent-framework flaws show that model-level guardrails can be bypassed entirely when tool execution isn't gated on authorized model turns, exposing widely deployed AI agent platforms to unauthorized tool invocation and potential data exfiltration.
Security flaws in agent infrastructure from AWS (Bedrock AgentCore's InvokeHarness API), Google (Agent Development Kit for Python), and Vercel (AI SDK harness packages for Codex and OpenCode) allow untrusted or forged instructions to reach an agent's tools without verifying that a model turn authorized them. In several attack paths the model never ran, so system prompts, content filters, and model-level guardrails never engaged. AWS fixed the managed service, Google addressed the issues in ADK 2.5.0, and Vercel patched @ai-sdk/harness-codex 1.0.29 and @ai-sdk/harness-opencode 1.0.28.