Hook
Three CVEs. One root cause. The orchestration layer trusts format over origin. Over the past month, AWS Bedrock, Google ADK, and Vercel SDK all disclosed vulnerabilities that bypass model-level alignment entirely. The data is clear: the weakest link in AI agents isn't the model—it's the plumbing. I've spent 26 years watching data pipelines, and this pattern is classic: an inspection-execution gap where the system verifies the shape of a message but not its source. The result? Any actor who can craft a properly formatted tool call can execute arbitrary actions, ignoring system prompts, refusal training, and even human approval gates.
Context
CoreBreak is the name given to a coordinated disclosure of three vulnerabilities across the three most popular AI agent development platforms. The research comes from Stealth (unnamed firm) and Adversa AI, presented at Black Hat and cited by the Cloud Security Alliance. The affected components: AWS Bedrock AgentCore (CVE-2026-18830, CVSS 8.6), Google ADK for Python (CVE-2026-18236, CVSS 9.3), and Vercel’s @ai-sdk/harness-codex/opencode (CVE-2026-64650/64651, CVSS 6.3). The commonality: the agent orchestration layer accepts tool-use content blocks without verifying they originated from a model round. In other words, the system checks if the data looks like a valid tool call, but not whether it was actually generated by the AI model.
This is not a minor bug. It’s a structural flaw in the architecture of modern AI agent frameworks. The data shows that model-level defenses—system prompts, RLHF, refusal classifiers—are completely bypassed because the attack occurs before the model even sees the input. The orchestrator simply passes the injected tool call to the execution environment. The GuardFall study, also highlighted in the research, found that 10 out of 11 AI coding agents are vulnerable to shell injection, confirming this is an industry-wide problem, not a one-off.
Core: The On-Chain Evidence Chain
Let’s dissect the evidence. The three CVEs share a common modus operandi: the orchestrator does not verify the provenance of tool calls.
- AWS Bedrock AgentCore: The InvokeHarness API accepts tool-use content blocks in the final message of a request. An authenticated remote caller can inject these blocks directly. The system assumes any block that looks like a valid tool call must have been generated by the model. It does not check the chain of custody. CVSS 8.6 reflects the high impact: integrity and confidentiality are compromised, but authentication is required. However, in many architectures, a low-privilege user can call this API. My 2017 ICO audits taught me that authentication is not a real barrier when the API is exposed behind a business service.
- Google ADK for Python: CVE-2026-18236 is the most severe, scoring 9.3. The vulnerability allows an attacker to manipulate or inject events into the session history. Why does that matter? Because the human approval mechanism for sensitive tools reads from that history. An attacker can forge a “user confirmed” event, bypassing the only safety net that many enterprises rely on. This is devastating. It means the “human-in-the-loop” narrative is a lie when the loop can be spoofed.
- Vercel SDK: The harness-codex and opencode packages check process paths to determine if a process is authorized. The path check trusts any process that includes an approved helper-script path in its command line. A malicious process inside a Linux sandbox can easily satisfy this check. CVSS 6.3 is lower, but the implication is still dangerous: a sandbox escape combined with this vulnerability can lead to arbitrary code execution under the agent’s identity.
The data tells a consistent story: the orchestrator is the weak link. The fix for all three is the same: the orchestrator must cryptographically or logically bind each tool call to a verified model round. AWS automatically deployed the fix to its managed Bedrock service by July 31. Google released ADK 2.5.0 on July 16. Vercel patched on July 20. But the key difference is execution: AWS customers are protected automatically; Google and Vercel users must manually update. The article explicitly states that self-hosted operators face “significant risk” if they delay.
Follow the gas, not the narrative. The narrative says “model alignment is the solution.” The gas—the raw execution data—shows that alignment is irrelevant when the orchestrator does not verify origin. The CVEs are not about prompt injection. They are about a fundamental trust assumption in the agent infrastructure. The GuardFall study reinforces this: 10 out of 11 coding agents can be exploited via shell injection, meaning the same pattern exists across the entire ecosystem.
Contrarian: Correlation ≠ Causation
A common reaction is to blame the models. “Better guardrails, better refusal training would have prevented this.” That’s false. The attack does not go through the model. The orchestrator receives a tool call that looks like a valid output from the model, but it was injected directly by an attacker. The model never sees the malicious input. No amount of RLHF can fix a plumbing layer that trusts format over origin.
Another contrarian angle: the automatic fix by AWS is not a silver bullet. Yes, if you use Bedrock’s managed agent, you are patched. But many enterprises build custom agents on top of Bedrock, using the InvokeHarness API directly. The patch applies to the service, but custom integrations may still have the same trust assumption. The CVE is specific to that API, yet the research team warned that “any system that assumes tool-call format data must have been generated by the model is vulnerable.” That includes custom harnesses, MCP-based integrations, and any pipeline that accepts tool calls from an untrusted source.
Also noteworthy: the human approval forgery in Google ADK destroys the last line of defense. Many enterprises deployed agents with a “human confirmation” step for critical actions like payments, permissions, or system changes. CoreBreak proves that this confirmation is only as secure as the session history. If the history can be tampered, the confirmation is meaningless. This is not a theoretical risk—it’s a documented CVE with a 9.3 score.
Takeaway: The Next Signal
The next 12 months will see a wave of agent security startups specializing in runtime verification, tool call signing, and orchestrator auditing. The industry must adopt a simple rule: every tool call must be cryptographically linked to a verified model round. No exceptions. The Cloud Security Alliance is already drafting guidelines. The question is not whether this will happen, but how fast. If you are running any agent in production—especially one that handles financial transactions or system changes—check your orchestration layer’s source verification. The data is clear: the plumbing is the new battlefield.
