Full Report
Security flaws in agent infrastructure from Amazon Web Services (AWS), Google, and Vercel let untrusted or forged instructions reach an agent's tools with no check that a model turn had authorized them. In several of the attack paths, the model never ran at all, so system prompts, content filters, and model-level guardrails never got a chance to intervene. The affected products include Amazon
Analysis Summary
# Vulnerability: CoreBreak - Model-Bypass in AI Agent Infrastructure
## CVE Details
- **CVE ID:** CVE-2026-18830 (Specifically for AWS Bedrock AgentCore)
- **CVSS Score:** 8.6 (High) [CVSS v4.0]
- **CWE:** CWE-20: Improper Input Validation
## Affected Systems
- **Products:**
- **Amazon Web Services:** Amazon Bedrock AgentCore (InvokeHarness API) and the underlying open-source **Strands** Python code.
- **Google:** Agent Development Kit (ADK) for Python.
- **Vercel:** AI SDK harness packages (Codex and OpenCode).
- **Versions:**
- AWS Bedrock AgentCore: Managed service versions prior to July 31, 2026.
- Google ADK: Versions prior to 2.5.0.
- Vercel: `@ai-sdk/harness-codex` < 1.0.29 and `@ai-sdk/harness-opencode` < 1.0.28.
- **Configurations:** Systems where agents are granted access to sensitive tools or credentials and allow untrusted input to influence the message history or session state.
## Vulnerability Description
Dubbed **"CoreBreak"**, this vulnerability involves a lack of provenance verification between the model's decision-making phase and the tool execution phase. In a standard flow, a Large Language Model (LLM) decides to call a tool and provides the arguments. However, these platforms contained logic that would automatically execute any "tool-use" block found in the input/history without verifying that an LLM actually generated that instruction in the current turn.
Because the model is bypassed entirely, traditional safeguards—such as system prompts, content filters, and model-level guardrails—never execute, allowing an attacker to trigger tool calls directly.
## Exploitation
- **Status:** PoC available (Presented at Black Hat USA 2026).
- **Complexity:** Medium (Requires understanding of the specific SDK's message structure).
- **Attack Vector:** Network (Authenticated remote request for AWS; attacker-controlled session events for Google; local sandbox for Vercel).
## Impact
- **Confidentiality:** High (Potential exfiltration of credentials or sensitive data via unauthorized tool calls).
- **Integrity:** High (Unauthorized execution of actions/tools).
- **Availability:** Moderate (Depends on the nature of the tools available to the agent).
## Remediation
### Patches
- **AWS:** Applied server-side validation to the managed Bedrock service on July 31, 2026. No customer action required for the managed API.
- **Google:** Update to **ADK version 2.5.0** or later.
- **Vercel:** Update `@ai-sdk/harness-codex` to **1.0.29** and `@ai-sdk/harness-opencode` to **1.0.28**.
### Workarounds
- **Strands Users:** For those using the standalone open-source Strands Python code, manually remove the logic in `event_loop.py` that shortcuts to tool execution when a `toolUse` block is detected in the latest message.
- **General:** Ensure agents follow the principle of least privilege by restricting tool access to only the minimum necessary functions.
## Detection
- **Indicators of Compromise:** Review logs for tool execution events that do not have a corresponding preceding LLM "model turn" or inference record.
- **Detection Methods:** Monitor for "tool-use" content blocks appearing in user-supplied input messages or API requests before they reach the agent's event loop.
## References
- **AWS Security Bulletin:** hxxps://aws[.]amazon[.]com/security/security-bulletins/2026-073-aws/
- **Black Hat Briefing:** hxxps://blackhat[.]com/us-26/briefings/schedule/#the-corebreak-attack-turning-ai-agents-into-credentials-exfiltration-vectors-53825
- **Strands Repository:** hxxps://github[.]com/strands-agents/harness-sdk/blob/main/strands-py/src/strands/event_loop/event_loop.py