Silence in the code speaks louder than the hype. In July 2026, while the crypto market fixated on ETF flows and Layer-2 TVL, a different kind of vulnerability was quietly being patched across three major AI agent platforms. It didn't involve a flash loan, a reentrancy bug, or a compromised private key. It involved something far more fundamental: the assumption that a piece of data that looks like a tool call must have come from the model.
We trace the ghost in the machine’s memory. This is CoreBreak — a family of vulnerabilities discovered by the security research firm Stealth, affecting AWS Bedrock AgentCore, Google ADK for Python, and Vercel’s AI SDK harness modules. The finding is not a single exploit, but a pattern: the scheduler layer in these agent architectures validates the shape of incoming data, not its provenance. Any authenticated caller — or in some cases, any process that can inject events into the session history — can bypass the model entirely and force the agent to execute arbitrary tools, including those that require human approval.
Based on my years auditing smart contracts and DeFi protocols, I’ve seen this pattern before. In 2017, I dissected ICO vesting schedules that trusted calldata shapes without verifying the sender. In 2020, I reverse-engineered Compound’s liquidation logic and found a similar inspection-execution gap in price oracle updates. The ledger remembers what the market forgets. CoreBreak is the same architectural flaw, now applied to the AI agent stack. The consequences are magnified because agents are being deployed to execute financial transactions, modify databases, and approve code merges. The model is not the problem; the plumbing is.
Context: The Agent Plumbing Layer
An AI agent is not just a model. It’s a stack: a user interface, an orchestrator, a scheduler, a model, and a set of tools. The scheduler is the critical pipe that decides which tool to call based on the model’s output. In most frameworks, the scheduler receives a JSON-like structure from the model that specifies the tool name, arguments, and optionally a request for human confirmation. The scheduler then executes the tool. The problem is that the scheduler does not verify that the tool call actually originated from the model. It only checks that the structure is valid — that the JSON has the right fields.
CoreBreak exploits this gap. The three CVEs — CVE-2026-18830 (AWS, CVSS v4 8.6), CVE-2026-18236 (Google, CVSS v4 9.3), and CVE-2026-64650/64651 (Vercel, CVSS v4 6.3) — all share the same root cause: the scheduler accepts tool call blocks from any source, as long as they are shaped correctly. In AWS, an authenticated remote caller can inject tool use blocks into the final message of the InvokeHarness API. In Google ADK, an attacker can manipulate the session history to forge a human approval for a sensitive tool. In Vercel, a process path check can be bypassed by a malicious process that shares the same file path as an approved helper script.
This is not a model-level vulnerability. No amount of system prompts, refusal training, or alignment can prevent it because the attack never touches the model. The model is not even aware. The attack happens at the scheduler — the layer that is supposed to be a neutral pipe. Chaos is just data waiting for a lens. CoreBreak is the lens that reveals the chaos.
Core: The On-Chain Evidence Chain
Let’s look at the data. The three CVEs were reported to vendors with coordinated disclosure timelines. Google ADK patched in version 2.5.0 on July 16, Vercel SDK patched on July 20, and AWS automatically deployed fixes by July 31. The CVSS scores tell a story: Google’s 9.3 is the most severe because it allows forgery of human approval — a direct attack on the human-in-the-loop assumption that many enterprises rely on. AWS’s 8.6 is high but requires an authenticated remote caller, which in practice means any user of the backend API. Vercel’s 6.3 is lower because it requires local process access, but in a CI/CD pipeline, that’s often trivial.
The research by Stealth is not just a bug report; it’s a pattern recognition. They also referenced the GuardFall research by Adversa AI, which tested 11 AI coding agents and found 10 vulnerable to shell injection via the same pattern. The industry-wide implication is clear: if you are building an agent that can execute tools, and your scheduler does not cryptographically bind each tool call to a specific model inference round, your agent can be hijacked without any prompt injection.
Finding the signal where others see only noise. The signal is that the trust model is broken at the architecture level. The noise is the endless debate about model alignment. Alignment is important, but it doesn’t matter if the scheduler can be tricked into executing a tool that the model never intended.
Let me give you a concrete example from my own experience. In 2021, I spent two weeks tracing the ownership clusters of 100 Bored Ape Yacht Club NFTs. I found that 15% of supposedly unique holders were controlled by a single entity. The on-chain data showed the same pattern: the ledger recorded the transfers, but the metadata didn’t verify the origin. CoreBreak is the same: the scheduler records the tool call, but doesn’t verify the origin. The result is a phantom transaction — a tool execution that looks legitimate but was never approved by the model or the human.
Contrarian: The Self-Hosted Trap and the Cloud Mirage
One might think that the obvious fix is to use a fully managed agent platform like AWS Bedrock, which automatically patched the vulnerability. But the contrarian reality is more nuanced. The automatic patch only works if the underlying infrastructure is updated. In multi-tenant environments, the patch might roll out silently, but the API contract remains the same. The vulnerability is not in the model; it’s in the protocol. As long as the scheduler trusts the shape of the data, any future protocol extension could reintroduce the same flaw.
Moreover, the self-hosted vs. managed dichotomy is a false sense of security. Google ADK can be used both as a self-hosted Python library and as a managed service in Vertex AI. The article did not specify whether the Vertex AI version was also vulnerable. If it was, and if it required manual patching, then Google’s cloud advantage evaporates. The same applies to Vercel. Their Edge Runtime is a managed environment, but the process path check vulnerability could still be exploited if the attacker can control a process within the sandbox.
The contrarian angle is that the repair is not just a code patch; it’s a fundamental redesign of how agents handle tool calls. The industry must move to a model where each tool call is signed by the model’s inference session, using a cryptographic key that is rotated per inference round. This is analogous to how Ethereum transactions must be signed by the private key of the sender. Without that, the scheduler is just a blind relay.
Unraveling the thread that binds value to vision. The vision is that agents will autonomously execute complex tasks. The value is that they will do so securely. CoreBreak shows that the thread is frayed. The industry must weave a new thread: provenance-based authorization.
Takeaway: The Next Bull Run Will Be Built on Trust
CoreBreak is not a single exploit; it’s a category. Over the next 12 months, every agent framework will need to implement source verification for tool calls. The market will see new startups focused on agent runtime security, offering middleware that sits between the scheduler and the tools to enforce cryptographic provenance. The cloud providers will compete on their ability to provide “trusted execution” for agent workloads. The enterprise security teams will need to add agent flow monitoring to their SIEMs, tracking not just model I/O but also scheduler-level events.
Dreaming in algorithms, waking up in truth. The truth is that the AI agent revolution will be built on trust — trust that the machine executes only what it was told. CoreBreak is a reminder that trust must be engineered, not assumed. The ledger remembers what the market forgets. Let’s not forget this lesson.
