AWS, Google, and Vercel Agent Flaws Let Attackers Trigger Tools Without Running the Model

August 6, 2026 · The Hacker News · Severity: MEDIUM

Security flaws in agent infrastructure from AWS, Google, and Vercel allowed attackers to bypass AI model authorization checks and directly trigger tools without model execution. The vulnerabilities affected Amazon Bedrock AgentCore's InvokeHarness API (CVE-2026-18830), Google's Agent Development Kit for Python (CVE-2026-18236), and Vercel's AI SDK harness packages for Codex and OpenCode agents. Attackers could exploit these flaws to execute unauthorized tool calls by injecting malicious instructions, though each platform had different attack requirements ranging from authenticated requests to sandboxed code execution. AWS, Google, and Vercel have patched their managed services, though some open-source components like AWS's Strands framework still retain vulnerable code paths. The vulnerabilities, collectively called CoreBreak by researchers from Stealth, undermine the fundamental security model of AI agents where tools should only execute after model authorization. While the impact depends on each agent's capabilities, the flaws could allow attackers to bypass content filters and safety guardrails. AWS addressed its managed service but left Strands unpatched, documenting the risk instead. Google fixed its ADK in version 2.5.0, and Vercel released updates for its harness packages. These issues highlight the importance of proper input validation in AI agent architectures to prevent unauthorized tool execution.