CoreBreak: AWS, Google and Vercel Agents Tricked Into Running Tools Without the Model

At the Black Hat USA 2026 conference, Stealth co-founders Hedi Ingber and Aviyam Ivgi presented a class of vulnerabilities they dubbed CoreBreak. The core of the problem is the same across the AWS, Google and Vercel platforms: an agent's execution layer accepted data that looked like a tool call from the model and ran that tool without checking whether the model had taken a turn at all.

In the normal scenario, the SDK passes the model the user's request, the system prompt, the conversation history and descriptions of the available tools. The model decides whether to call a tool and returns a structured instruction with a name and arguments, which the SDK executes. In the vulnerable implementations, the origin of the data was not verified between those last two steps — which means an attacker did not have to coax the model into breaking the rules. He could reach the dispatcher directly. As the authors stress, this is not prompt injection: there is nothing to deceive, because the model never gets a turn, and along with it the system prompts, content filters and model-level guardrails all sit idle.

Three different platforms, one root cause

The conditions for the attacks differed. In Amazon Bedrock AgentCore (CVE-2026-18830, CVSS 8.6), an authenticated remote user could place a tool-use block in the final message of an InvokeHarness request, and the event loop would call the named tool directly. AWS added a server-side check that rejects such blocks; the fix was applied automatically. That said, in the open-source Strands code on which the harness is built, the workaround remained — AWS classified it as the customer's responsibility and limited itself to documentation, and an April pull request removing the shortcut was closed without merging on June 19.

In Google ADK for Python, two paths were found at once. The primary one (CVE-2026-18236, CVSS 9.3) allowed an attacker to forge a confirmation for a sensitive tool by tampering with the session history: the confirmation processor did not verify the tool, its ownership by the agent, or that the arguments matched. The second path involved resumable mode, where user events with function_call parts were treated as commands to run tools. Both were fixed in ADK 2.5.0.

The Vercel vulnerabilities (CVE-2026-64650 and CVE-2026-64651, CVSS 6.3) required that malicious code already be running in a Linux sandbox: the relay trusted a process if its command line contained the path of an approved helper script. This made it possible to invoke host tools — secret scanning, deployment operations, calls to cloud APIs. In harness-codex 1.0.29 and harness-opencode 1.0.28, the fallback path was removed, and each request is now tied to a one-time authorization.

The common takeaway

All three fixes converge on a single principle: the shape of incoming data must not stand in for the model's turn. Google checks the confirmation against the recorded call, Vercel ties the request to a specific model event, and AWS rejects the user block before the event loop. The damage is bounded by what the agent is already permitted to do: an agent without sensitive tools gives the attacker nothing. There is no evidence that the vulnerabilities were exploited in real-world attacks before the patches were released.

Source: The Hacker News