Over the past 90 days, three major AI agent frameworks — AWS Bedrock, Google ADK, and Vercel SDK — were found to share a critical flaw: they trust the shape of a tool call, not its origin. The result? A single forged message can bypass all model-level safeguards and execute arbitrary code. I have seen this pattern before. In 2018, I audited a smart contract for the virtual real estate project EtherCity. The ownership transfer function checked only that the caller's address ‘looked like’ a valid owner — it never verified the cryptographic signature. The result was a $40 million wipeout. The same mistake is now being repeated at scale in AI agent infrastructure, and the crypto industry is the most exposed victim.
Context: The Rise of AI Agents in Crypto
Crypto projects have embraced AI agents with a fervor that mirrors the ICO mania of 2017. Automated trading bots, portfolio managers, and DeFi interaction agents are now built on top of frameworks like AWS Bedrock’s AgentCore, Google’s ADK, and Vercel’s @ai-sdk. These agents promise to execute complex transactions, manage risk, and even approve multi-signature operations. The underlying assumption is that the AI model — the “brain” — is trustworthy because it has been trained to reject malicious instructions. But the vulnerabilities disclosed by the security firm Stealth and the research group Adversa AI prove that the brain is irrelevant if the spinal cord is severed.
Core: The Inspection-Execution Gap
The three CVEs — CVE-2026-18830 (AWS Bedrock AgentCore, CVSS 8.6), CVE-2026-18236 (Google ADK for Python, CVSS 9.3), and CVE-2026-64650/64651 (Vercel @ai-sdk/harness-codex, CVSS 6.3) — share a common root cause: the scheduling layer verifies the format of a tool call, but not its provenance. In AWS Bedrock, the InvokeHarness API accepts tool-use content blocks in the final message of a request, without checking whether those blocks were actually generated by the model. In Google ADK, an attacker can inject events into the session history to forge human approval for sensitive tools. In Vercel’s SDK, the process path check trusts any command-line argument that contains a whitelisted script path, even if the process itself is malicious.
This is not a model-level bug. It is an infrastructure-level design flaw. The scheduler assumes that any data formatted as a tool call must have been generated by the model. This is equivalent to a blockchain accepting any transaction that looks correctly signed without verifying the actual signature. The research team at Stealth called it the “CoreBreak” pattern, and it is a textbook example of the inspection-execution gap — a concept every software security engineer knows but the AI industry has chosen to ignore.
The GuardFall research, released simultaneously, shows that 10 out of 11 tested AI coding agents can be exploited via shell injection. The same plumbing-level trust failure is present in LangChain, CrewAI, and Microsoft AutoGen — though those were not part of the coordinated disclosure. The message is clear: the entire AI agent ecosystem is built on a foundation of sand.
Contrarian: The Patches Are Not Enough
The bulls will point out that all three vendors have released patches. AWS automatically deployed the fix to Bedrock by July 31, 2026. Google ADK 2.5.0 was released on July 16, and Vercel SDK 1.0.29/1.0.28 on July 20. The argument is that the vulnerability is now closed, and the impact is limited because exploitation requires authenticated access. But this is a dangerous illusion.
First, the patches are not equal. AWS’s managed service means every customer is protected, but Google ADK and Vercel users must manually update. In a typical enterprise, agent frameworks are deployed in containers, often pinned to older versions for stability. The attack surface remains open for months. Second, the patch does not fix the underlying architecture. The scheduler still trusts the shape of tool calls; it only adds a few extra checks. The same pattern will reappear in the next iteration of the framework. The only true fix is to embed cryptographic provenance at the scheduling layer — linking every tool execution to a specific model inference session via a signed hash.
This is where blockchain technology offers a natural solution. Imagine a system where every tool call must be accompanied by a cryptographic commitment from the model’s inference session. The scheduler verifies the commitment before executing. The “ledger” of tool calls becomes an immutable audit trail. This is exactly what several crypto-native AI projects are attempting with on-chain verifiable inference. The irony is that the industry that created the trust problem is also the one that holds the technological key to solving it.
Takeaway: The Next Exploit Will Drain the Treasury
The CoreBreak vulnerabilities are a warning shot. The next generation of AI agents will not be secure unless they adopt a blockchain-style trust model. We traded value for visibility in the NFT market, and lost both. Now we are trading security for convenience in AI agent infrastructure. The ledger remembers what the hype forgets. The question is: will the industry learn before the next exploit drains the treasury?
