Three CVEs, one pattern: AI agent frameworks trust data shape over source. CoreBreak proves it. AWS Bedrock AgentCore, Google ADK, Vercel SDK – all three let attackers inject tool calls directly into the execution pipeline. Model-level guardrails? Completely bypassed. The scheduler checked the format, not the origin. That is a design flaw, not a bug.
Context: Why Now
The industry spent 2025 obsessing over model alignment – red-teaming prompts, training refusal boundaries, enforcing system instructions. But CoreBreak, disclosed in July 2026, shows that the real attack surface is not the model. It is the plumbing. The AgentCore layer that routes tool calls from the model to external APIs never verified that the call actually came from the model. It only checked that the data looked like a valid tool call. This is the inspection-execution gap. And it is structural.
Google ADK’s CVE-2026-18236 (CVSS 9.3) allows an attacker to inject events into session history, forging a human approval for a sensitive tool. AWS Bedrock’s CVE-2026-18830 (CVSS 8.6) lets an authenticated remote caller insert tool-use content blocks directly into the final message – no model involvement needed. Vercel’s two CVEs (6.3) trust any process whose path matches an approved helper script, even if the process is malicious code running in a sandbox. Three different platforms, one root cause: the scheduler assumes that any data shaped like a tool call must have been generated by the model.
Core: The Technical Breakdown
Let me be surgical. Based on my experience auditing smart contracts during the 2017 ICO boom – where I found reentrancy bugs by checking execution context, not just function signatures – the same pattern repeats here. The scheduler is a “shape matcher,” not a “provenance checker.” It sees a JSON object with a tool name and arguments, and executes it. It does not ask: “Was this object produced by the model in this turn?” That missing check is the entire vulnerability.
AWS Bedrock’s InvokeHarness API accepts a final message with tool-use content blocks. The scheduler does not verify that the blocks were generated by the model during the agent’s reasoning loop. An attacker with API access – even a low-privilege user – can craft a final message that contains a tool call to delete a database, transfer funds, or modify permissions. The system prompt says “never execute dangerous actions,” but the scheduler never reads the prompt. It only reads the data shape.
Google ADK’s vulnerability is even more dangerous because it targets the “human-in-the-loop” safety net. The confirmation handler processes events from session history without verifying that the event corresponds to a genuine tool invocation from the current user session. An attacker can inject a fake “human approved” event into the history, causing the agent to execute a sensitive tool as if a human had confirmed it. The audit trail will show “human confirmed,” but that confirmation was a forgery. Silence in the ledger speaks louder than hype.
Vercel’s CVEs are more subtle but equally telling. The process path check approves any process whose path contains a pre-approved helper script. A malicious process inside the sandbox can simply name itself with that path string. The check passes. Data does not negotiate; it only confirms.
GuardFall, a parallel study by Adversa AI, tested 11 AI coding agents. 10 could be bypassed via shell injection. This is not a handful of bugs. It is an industry-wide architectural assumption: the pipeline is trusted. The model is not.
Contrarian: The Unreported Angle
The prevailing narrative will be “patch your agents.” That is wrong. The real story is that the entire agent design paradigm – trust the scheduler, verify the model – is broken. The industry has been optimizing for “model safety” while ignoring the execution layer. This is analogous to the 2020 DeFi yield farming bubble: protocols promised high APY without checking the sustainability of the token emission schedule. I published a short signal two days before the crash. The same pattern is playing out in AI agent infrastructure.
Google ADK’s human approval forgery is the most underappreciated risk. Enterprise teams deploying agents for financial transactions, contract signing, or system changes rely on the “human approval” step as the ultimate safeguard. CoreBreak proves that step can be fabricated. The audit trail never lies, only the auditor can. But if the audit trail shows a fake approval, the auditor sees nothing wrong.
Another overlooked angle: the Model Context Protocol (MCP). The study mentions MCP as a potential future vector. If MCP becomes the standard communication layer for agents, the same trust assumption will propagate across hundreds of frameworks. The supply chain debt is massive. Companies that rushed to adopt MCP without a provenance verification layer are now exposed.
Finally, the commercial implications. AWS automatically fixed its service. Google and Vercel released patches, but self-hosted users must upgrade manually. This creates a bifurcation: managed platforms will brand themselves as “secure by default,” while open-source toolkits will require devops overhead. The security research firms that uncovered these bugs – Stealth and Adversa AI – will become the new gatekeepers of AI agent security. Expect a surge in funding for agent runtime monitoring startups.
Takeaway: What to Watch Next
The next 12 months will force a rewrite of every agent framework’s scheduler. The fix is not a patch; it is a fundamental redesign: every tool call must carry a cryptographic or logical binding to a verified model inference round. Without that, the pipeline will always be the weakest link. The question is not whether the next CoreBreak will appear, but how many production agents are already running on unpatched, trust-the-pipeline architectures. The audit trail is silent. Are you listening?
