{"slug": "corebreak-flaws-let-agent-tools-run-without-the-model-ever-being-called", "title": "CoreBreak Flaws Let Agent Tools Run Without the Model Ever Being Called", "summary": "The Cloud Security Alliance published a research note on August 6, 2026 describing CoreBreak, a set of four CVEs across Amazon Bedrock AgentCore, Google's Agent Development Kit (ADK) for Python, and Vercel's AI SDK harness packages, in which the tool-dispatch layer executed a tool call without verifying that a language model had produced it. The vulnerabilities, presented at Black Hat USA 2026 by security researchers Hedi Ingber and Aviyam Ivgi of Stealth, include CVE-2026-18830 (CVSS 8.6 High), CVE-2026-18236 (9.3 Critical), CVE-2026-64650 and CVE-2026-64651 (6.3 Medium each). Vendor fixes are available: AWS deployed automatically before July 31, 2026, Google shipped ADK for Python 2.5.0 on July 16, 2026, and Vercel shipped harness-codex 1.0.29 and harness-opencode 1.0.28 on July 10, 2026.", "body_md": "## What happened\n\nThe Cloud Security Alliance published a research note on August 6, 2026 describing CoreBreak, a set of four CVEs across AWS, Google, and Vercel agent frameworks in which the tool-dispatch layer executed a tool call without verifying that a language model had actually produced it. All four have vendor fixes.\n\nThe Cloud Security Alliance's AI Safety Initiative published a research note on August 6, 2026 describing a cross-platform vulnerability pattern the researchers named CoreBreak. According to the note, security researchers Hedi Ingber and Aviyam Ivgi, co-founders of the security firm Stealth, presented findings at Black Hat USA 2026 showing that the tool-execution layers of Amazon Bedrock AgentCore, Google's Agent Development Kit (ADK) for Python, and the harness packages distributed with Vercel's AI SDK could each be induced to run a tool without a legitimate model turn ever occurring. Because the language model was never invoked, the note argues, guardrails built around the model had no decision to intervene in.\n\nAgent frameworks of this kind share a common structure. An orchestration layer bundles the user request, system prompt, conversation history, and a catalog of available tools, sends it to a language model, and waits for the model to return a structured instruction naming a tool and its arguments. The SDK then dispatches the corresponding function, script, or API call and feeds the result back into the conversation. CoreBreak targets the last step: according to the note, the dispatch logic in each of the three products treated data that merely resembled a model-generated tool call as authoritative, without checking where it came from.\n\nThe note lists four CVE identifiers with distinct exploitation paths, citing vendor bulletins and National Vulnerability Database entries. AWS assigned CVE-2026-18830 (CVSS v4.0 8.6, High) to the Bedrock AgentCore harness flaw, where an authenticated remote caller could place a tool-use content block directly in the final message of an InvokeHarness API request. Google assigned CVE-2026-18236 (9.3, Critical) to an ADK flaw in which an attacker able to inject events into session history could forge a human-approval confirmation, because the confirmation processor did not check that the target tool belonged to the executing agent, that it actually required confirmation, or that its name and arguments matched the original recorded call. Vercel's @ai-sdk/harness-codex and @ai-sdk/harness-opencode received CVE-2026-64650 and CVE-2026-64651 (6.3, Medium each), where malicious code already running inside a Linux sandbox could satisfy a process-path check that trusted any process whose command line contained the path of an approved helper script.\n\nFixes are available, but the burden differs by deployment model. The note says AWS's fix to the fully managed Bedrock AgentCore InvokeHarness API deployed automatically before July 31, 2026 and required no customer action, though it still advises confirming coverage for a given region and configuration. Google's fix shipped in ADK for Python version 2.5.0 on July 16, 2026, and Vercel's fixes shipped in harness-codex 1.0.29 and harness-opencode 1.0.28 on July 10, 2026 — package updates that self-hosted operators must apply themselves. The note frames CoreBreak as distinct from prompt injection: prompt injection tries to manipulate the model's judgment, while CoreBreak bypasses the question of whether the model exercised judgment at all.\n\n[Read the primary source: labs.cloudsecurityalliance.org ↗](https://labs.cloudsecurityalliance.org/research/csa-research-note-agent-infra-guardrail-bypass-20260806-csa/)\n\n## Why it matters\n\nContent filters, system prompts, refusal training, and human-approval gates all assume the model is the party deciding whether a tool runs. If the dispatch layer accepts anything shaped like a model's tool call, those controls are bypassed rather than defeated — and the logs monitoring teams normally inspect never get created.\n\nMost enterprise controls for agentic AI sit on or around the model. System prompts restrict sensitive actions, content filters score inputs and outputs, refusal training is baked into model weights, and human-confirmation steps gate high-risk tools. Every one of those controls presumes the model is the party that decides whether a tool runs. If a dispatch layer will execute any payload that is correctly shaped, those investments provide little preventive protection — not because they were poorly designed, but because the attack routes around the place where they operate. That is a different class of problem from a guardrail that can be argued past.\n\nThe specific capabilities behind these dispatch layers are what give the finding weight. The note says the Vercel flaws could reach host-exposed tools including secret lookups, deployment operations, and cloud API calls. The Google flaw is more pointed still: it allowed forged confirmations to reach tools deliberately placed behind human approval, which is the control organizations reserve for actions considered too consequential to automate. A bypass that specifically neutralizes the human-in-the-loop step undermines the mitigation many teams cite when justifying broader agent autonomy.\n\nThe patch story also illustrates an asymmetry that will recur as agent tooling spreads. Customers of the fully managed AWS service were remediated without doing anything. Teams running Google's ADK or Vercel's harness packages in their own environments have to notice the advisory, update the dependency, and redeploy — and dependency updates in production stacks routinely lag by weeks or months. The same underlying design gap therefore has a very different practical exposure window depending on whether an organization consumes agent infrastructure as a service or vendors it into its own codebase.\n\nThere is also a detection gap. The note observes that security monitoring for agentic systems has generally focused on model inputs and outputs — logging prompts, flagging suspicious completions, reviewing which tools the model chose. When a tool executes without the model running, none of those artifacts exist to be logged. Several important things remain unknown: the note reports no evidence of exploitation in the wild, gives no estimate of how many deployments were affected, and does not describe proof-of-concept code. CSA is candid that two disclosures across four vendors do not prove an industry-wide pattern, and that the observed severity gradient is one data point rather than a scoring rule.\n\n## What to watch next\n\nWhether self-hosted operators actually apply the Google and Vercel package updates, whether similar provenance gaps surface in other agent frameworks, whether any in-the-wild exploitation is reported, and whether vendors move to signed, session-bound authorization tokens for tool execution.\n\nThe most concrete near-term question is patch uptake. AWS's managed fix is described as already deployed, but ADK 2.5.0 and the two Vercel harness releases only help operators who install them. Watch for downstream signals — package registry adoption rates, vendored forks that never pull the update, and internal platform images that pin older versions. The note also recommends a retrospective check: reviewing logs for tool invocations that cannot be tied to a corresponding, well-formed model completion in the session record. Whether organizations have the dispatch-layer telemetry to run that check is itself unresolved.\n\nThe second question is scope. CoreBreak covers three products, but the described pattern — trusting a payload's shape or a process's command line as proof of model authorization — is not specific to them. Any framework with the same SDK-to-model-to-tool structure could carry a comparable gap. Watch for further advisories from other agent framework maintainers, and for whether the researchers publish fuller technical detail after the Black Hat presentation. Additional confirmed cases would strengthen CSA's argument that this is a structural pattern rather than three coincidental bugs.\n\nThird, watch the architectural response. CSA's recommendation is to require cryptographic proof that a tool call originated from a real model completion — a signed, session-bound, one-time token — rather than inferring authorization from message structure or process identity. Whether major vendors adopt that model, and whether it becomes something buyers can ask for and verify during procurement, will determine if this disclosure changes designs or only produces patches. Confirmation-processing logic that validates tool ownership, confirmation requirement, and argument integrity against the original recorded call is the narrower version of the same fix.\n\nFinally, watch the governance and threat-intelligence tracks. CSA points to its MAESTRO threat-modeling framework and AI Controls Matrix v1.1 as places where execution-control and privilege-management assessments should now explicitly cover tool dispatch, and connects CoreBreak to its earlier GuardFall research on shell-level guardrail bypasses. Also worth monitoring: whether the NVD entries or CVSS scores are revised, whether vendors publish post-incident detail beyond the initial bulletins, and whether any confirmed exploitation emerges. None of the four CVEs currently carries a public report of in-the-wild abuse in the material CSA cites, and absence of such reports is not the same as absence of activity.", "url": "https://wpnews.pro/news/corebreak-flaws-let-agent-tools-run-without-the-model-ever-being-called", "canonical_source": "https://aiunderstanding.org/news/corebreak-flaws-let-agent-tools-run-without-the-model-ever-being-called", "published_at": "2026-08-16 23:30:37+00:00", "updated_at": "2026-08-16 23:41:47.852174+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "ai-policy"], "entities": ["Cloud Security Alliance", "Amazon Bedrock AgentCore", "Google", "Vercel", "Stealth", "Hedi Ingber", "Aviyam Ivgi", "Black Hat USA 2026"], "alternates": {"html": "https://wpnews.pro/news/corebreak-flaws-let-agent-tools-run-without-the-model-ever-being-called", "markdown": "https://wpnews.pro/news/corebreak-flaws-let-agent-tools-run-without-the-model-ever-being-called.md", "text": "https://wpnews.pro/news/corebreak-flaws-let-agent-tools-run-without-the-model-ever-being-called.txt", "jsonld": "https://wpnews.pro/news/corebreak-flaws-let-agent-tools-run-without-the-model-ever-being-called.jsonld"}}