The AgentCore Harness Bypass: A Structural Vulnerability #
A critical vulnerability in the AWS Bedrock AgentCore harness, identified as CVE-2026-18830, has exposed a fundamental flaw in how agentic systems process tool execution requests. With a CVSS score of 8.6, this vulnerability allowed authenticated users to execute tools while bypassing essential model invocation and security controls. The flaw centers on the InvokeHarness API, which failed to adequately validate input, effectively decoupling the tool execution logic from the intended model-mediated authorization layer.
Mechanism of the Harness Bypass #
The vulnerability manifested when the most recent message in an InvokeHarness request contained a tool-use content block. Under normal operating conditions, an agentic system relies on the large language model to authorize and generate tool calls. However, in this compromised state, the agent event loop bypassed the model entirely. It dispatched the named tool directly based on the caller-supplied content block, treating the input as if it had been generated and validated by the model itself. This failure to distinguish between model-generated instructions and untrusted user input created a direct path for unauthorized tool execution.
Companion Vulnerability: Path Traversal in MCP Server #
Alongside the AgentCore issue, researchers identified CVE-2026-18953, a path traversal vulnerability in the awslabs/aws-transform-mcp-server. Affecting versions 0.1.0 through 0.1.4, this flaw involved the savePath parameter, which permitted the writing of arbitrary files outside the intended working directory. This vulnerability, also carrying a CVSS score of 8.6, highlights the risks inherent in the broader ecosystem of agent-supporting infrastructure, where input validation failures can lead to significant system-level compromises.
CoreBreak Research and Cross-Platform Patterns #
Both vulnerabilities were discovered during the CoreBreak research project conducted by Stealth researchers Hedi Ingber and Aviyam Ivgi, and were subsequently presented at Black Hat USA 2026. The research team identified that the AgentCore bypass is not an isolated incident but rather part of a broader, cross-platform vulnerability class. CoreBreak found similar harness-layer bypasses in other major frameworks, including the Google ADK and the Vercel AI SDK. This pattern suggests a systemic issue in how modern agent harnesses are architected.
The Pattern: Forged Instructions as Authoritative #
The core of this vulnerability class lies in the trust model of the agent runtime. In these instances, untrusted or forged instructions reach agent tools without the necessary model authorization. The runtime environment incorrectly accepts data shaped like a model-generated tool call as authoritative. This behavior is effectively the agentic equivalent of SQL injection, where the input is misinterpreted by the execution engine as a command rather than data. This systematic failure indicates that many current agent frameworks lack the necessary boundary enforcement between the input layer and the execution layer.
AWS Response and Resolution #
Following the disclosure, AWS published AWS Security Bulletin 2026-073-AWS on August 4, 2026. The resolution for CVE-2026-18830 involved the implementation of server-side input validation. This update rejects caller-supplied tool-use content blocks in the final message of an InvokeHarness request before they can reach the agent event loop. Because this mitigation was applied server-side, no customer action was required to remediate the vulnerability within the AWS environment.
Implications for Agent Infrastructure Security #
The discovery of these vulnerabilities underscores the urgent need for a more rigorous approach to security in agent infrastructure. As agentic systems become more prevalent, the reliance on harnesses to mediate between models and tools creates a new, high-value attack surface. The cross-platform nature of these findings suggests that developers and platform architects must prioritize the implementation of strict input validation and authorization checks at the harness level. Moving forward, the industry must treat the separation of untrusted input from authoritative tool calls as a primary security requirement to prevent this category of vulnerability from undermining the integrity of agentic workflows.