AWS, Google, and Vercel Agent Flaws Let Attackers Trigger Tools Without Running the Model

Summary

Researchers from Stealth disclosed a cross-platform class of AI-agent flaws, dubbed CoreBreak, in which tool-call-shaped data is treated as authoritative without verifying that a legitimate model turn authorized it. In several attack paths the model never runs, so system prompts, content filters, and model-level guardrails cannot intervene. The affected products span Amazon Bedrock AgentCore's InvokeHarness API, Google's Agent Development Kit (ADK) for Python, and Vercel's AI SDK harness packages for the Codex and OpenCode coding agents.^[0]

These are distinct vulnerabilities with different attack conditions: AWS's involved an authenticated remote request, Google's required attacker-controlled session events or user-authored function calls, and Vercel's required untrusted code already running inside a Linux sandbox. Vendors have shipped fixes — AWS to its managed service, Google in ADK 2.5.0, and Vercel in @ai-sdk/harness-codex 1.0.29 and @ai-sdk/harness-opencode 1.0.28 — though AWS declined to code-fix the underlying open-source Strands resume path and issued documentation instead.^[0][12][17]

As of publication the advisories and CVE records do not indicate that any path was used against a live deployment before patching, and the researchers say they shared proof-of-concept code only privately with the affected vendors. The reported exposure is bounded by what each agent's wired tools can already do.^[0]

Attack chain

1. Normal expected flow: In a normal agent flow the SDK sends the user request, system prompt, history, and tool definitions to the model; the model returns a structured tool call, and the SDK executes it. The vulnerable paths failed to verify provenance between the model's decision and execution.^[0]
2. Craft tool-call-shaped data: An attacker crafts data shaped like a model-generated tool call — a tool-use content block in an InvokeHarness final message, forged confirmation or function_call events in an ADK session, or a process whose command line matches an approved helper script in a Vercel sandbox.^[0]
3. Reach the dispatch/authorization path without a model turn: The runtime receives the forged tool-call data and treats it as authoritative, reaching the dispatch or authorization path without a legitimate model turn, so the attacker need not persuade the model to break its rules.^[0]
4. Unauthorized tool execution: The named tool executes with attacker-chosen arguments, potentially invoking host-exposed capabilities such as secret lookups, deployment operations, and cloud API calls, bounded by the tools the agent is already wired to.^[0]

Disclosure timeline

How it works

The common root cause is that the execution layer treated tool-call-shaped data as sufficient authority without checking provenance. In a normal flow the model returns a structured instruction with a tool name and arguments and the SDK executes it; the vulnerable paths did not verify that a legitimate model turn produced the instruction.^[0]

For AWS (CVE-2026-18830), an authenticated remote user could place a tool-use content block in the final message of an InvokeHarness request; the event loop would then dispatch the named tool directly without asking the model. The comparable open-source Strands path uses a helper _has_tool_use_in_latest_message that, when it passes, sets the stop reason to tool_use, takes the latest message, and skips model execution — with a code comment reading 'Skip model invocation if the latest message contains ToolUse.'^[0][35]

For Google ADK, the continuation-forgery flaw (CVE-2026-18236) stemmed from a confirmation processor that did not verify the target tool belonged to the executing agent, that the tool actually required confirmation, or that its name and arguments matched the original recorded call; an attacker injecting session events could forge approval. A separate resumable-mode path accepted user-authored events containing function_call parts that were interpreted as instructions to run registered tools, bypassing the LLM.^[0][15]

For Vercel (CVE-2026-64650 / CVE-2026-64651), the harness relay trusted a process whenever its command line contained the path of an approved helper script (host-tool-mcp.mjs for OpenCode, a Codex command-line shim for Codex). Malicious code already running in the Linux sandbox could satisfy that check and invoke host-exposed tools without a model-authorized event — a local sandbox-to-host authorization bypass classified under CWE-863.^[0][19][20]

The three remedies converge on binding execution to a verified model turn: Google checks the confirmation against the tool and arguments recorded in the session, Vercel binds each relay request to an exact, short-lived, one-time authorization tied to an observed model event, and AWS rejects caller-supplied tool-use blocks before the event loop sees them.^[0]

Affected versions and patch status

Key takeaways

• This is not prompt injection: there is no probabilistic model to fool because the model never gets a turn, so model-level guardrails offer no protection and authorization must sit at the tool execution layer.^[0]
• The same authorization-versus-input-shape flaw recurred independently across three major vendors' agent stacks, indicating a systemic design pitfall in how agent runtimes trust tool-call-shaped data.^[0]
• CVE records for these issues contain errors — the Vercel Codex and OpenCode entries mislabel packages and fixed versions, and CVE-2026-18236 should not be treated as an umbrella for both Google findings — so defenders should map packages to advisories directly rather than rely on CVE text.^[0]
• AWS's decision to leave the open-source Strands model-skipping path unfixed under its shared-responsibility model means developers deploying standalone Strands remain responsible for building trusted message history themselves.^[0]

Defensive actions

• Upgrade the affected packages: Google ADK for Python to 2.5.0 or later, @ai-sdk/harness-codex to 1.0.29 or later, and @ai-sdk/harness-opencode to 1.0.28 or later.: These releases add provenance checks that reject tool-call data not tied to a legitimate model turn.^[0]
• Treat caller-authored tool calls as untrusted, including conversation history, resumable events, confirmation responses, and structured tool-use blocks when they cross an external boundary.: The vulnerable runtimes treated tool-call-shaped data as authoritative; AWS's guidance instructs developers to build message history from their own application rather than from caller-shaped input, since a tool-call block as the latest message runs the tool directly with no model call.^[0]
• Authorize at execution time by binding each tool invocation to the exact model event, tool name, arguments, session, and authorization state that produced it.: Safeguards implemented only in a system prompt or model response disappear when a caller can reach the dispatch path without a model turn; the fixes converge on this control.^[0]
• Reduce inherited authority by granting each agent only the tools, cloud roles, credentials, and write permissions its task requires.: Exposure is bounded by what each agent can already do, so an agent wired to no sensitive tools gains an attacker nothing.^[0]