Hook
Three CVEs. CVSS 9.3, 8.6, 6.3. All disclosed within a two-week window in July 2026. The common thread: AI agent scheduling layers accept tool call payloads by shape, not by source. AWS Bedrock, Google ADK, Vercel SDK—three different stacks, same architectural rot. The model never saw the injection. The guardrails never fired. The tool executed anyway.
This is not a prompt injection. This is an infrastructure-level exploit that bypasses the entire model stack. And it’s not an isolated bug—it’s the default design pattern.
Context
CoreBreak, as the research team at Stealth Security dubbed it, covers three independent vulnerabilities in major AI agent frameworks. CVE-2026-18830 (AWS Bedrock AgentCore) allows an authenticated remote caller to inject tool-use content blocks into the final message of an InvokeHarness API request. The scheduler does not verify whether the block originated from a model round. CVE-2026-18236 (Google ADK for Python) enables an attacker to manipulate or inject events into the session history, thereby forging human approval for sensitive tool calls. CVE-2026-64650/64651 (Vercel @ai-sdk/harness-codex/opencode) trusts that any process whose command line contains a path to an approved helper script is legitimate—a trivial bypass in a sandbox.
These are not edge cases. They reflect a universal assumption in agent design: if the data looks like a tool call, it must have come from the model. The scheduler acts as a shape matcher, not a provenance verifier. The result is an inspection-execution gap that leaves the entire execution chain vulnerable to direct manipulation.
Core
Let me break this down at the code level, because the abstraction matters.
In AWS Bedrock AgentCore, the InvokeHarness API accepts a finalMessage parameter. The scheduler parses this message for toolUse content blocks. If found, it executes them. The API does not check whether the block was generated by the model during the current invocation. It does not cryptographically bind the block to a model round. It simply checks the JSON structure: { "type": "toolUse", ... }. Shape match → execute. The model’s own output is one source, but the API endpoint is a separate channel. The attacker sends a crafted request with the correct shape, and the scheduler trusts it.
This is the same class of vulnerability I encountered in 2017 while auditing the EtherFund ICO contract. The ERC-20 transfer function checked the value parameter for shape (uint256) but not for overflow boundary. The logic assumed: if the user sends a valid uint256, it must be safe. That assumption cost 12% of the fund. The fix then was a simple require(balanceOf[msg.sender] >= _value). The fix now is to require a cryptographic signature that the tool call originated from the model’s output.
Google ADK’s flaw is more insidious. The session history is a list of events. The approve_tool event is supposed to represent human consent. But the scheduler does not validate that the event was generated by the UI. An attacker can inject a forged approve_tool event directly into the session history stream. The scheduler sees the event, matches the shape, and executes the tool. The human never saw the request. The approval is a lie.
“Yield is the interest paid for ignorance.” The industry has been paying yield on the assumption that tool call shape equals trust. That assumption is now broken.
Vercel’s vulnerability is a classic path-based trust bypass. The opencode process checks whether the calling process’s command line includes a path to an approved helper script. In a Linux sandbox, an attacker can spawn a process with a command line that includes the approved path but also malicious arguments. The scheduler sees the path, trusts the process, and grants execution. Shape over source, again.
These three CVEs are not coincidental. They are symptoms of a design pattern that permeates the agent infrastructure layer. The Model Context Protocol (MCP), which is becoming the standard for agent-tool communication, inherits the same assumption. If MCP messages carry tool calls without provenance, the vulnerability becomes supply-chain scale.
Contrarian
The common narrative is that AI safety is about alignment—training models to refuse harmful instructions. System prompts, RLHF, red-teaming. These are the frontline defenses. CoreBreak shows that these defenses are irrelevant when the attacker can directly inject into the execution pipeline. The model never sees the malicious instruction. The I/O logs show nothing. The guardrails are a facade.
“Code is law, but human greed is the bug.” The greed here is the rush to ship agents without building a provenance layer. Every framework prioritized developer experience over execution integrity. The result is a class of vulnerability that no amount of model-level filtering can fix.
Another blind spot: the “human-in-the-loop” safeguard. Many enterprises deploy agents with the rule that sensitive actions require human approval. Google ADK’s CVE-2026-18236 proves that the approval mechanism itself is not a trusted root. If the session history can be tampered with, the approval is just another event. The human is not in the loop—the attacker is.
This is not hypothetical. The GuardFall study from Adversa AI tested 11 AI coding agents. 10 of them were vulnerable to shell injection via the same scheduling layer bypass. The coding agent executes shell commands based on tool call shapes, not source. The impact on software supply chain integrity is severe: an attacker can inject a tool call that causes the agent to generate backdoored code, and no one sees it because the model’s output log shows a clean response.
Takeaway
The next 12 months will see a scramble to retrofit provenance into agent execution pipelines. Cryptographic binding of tool calls to model rounds. Immutable audit trails for session events. Runtime verification of approval origins. This is the AI industry’s SolarWinds moment—a wake-up call that the infrastructure layer is not secure by default.
For blockchain-based agents—DeFi trading bots, DAO governance executors, automated market makers—the implications are immediate. An on-chain agent that trusts an off-chain tool call without provenance is a rug pull waiting to happen. The fix is not harder, but it requires admitting that the current design is broken.
“Ledgers do not lie, only their auditors do.” The code is honest. The assumption is the lie. Time to audit the assumption.
Signatures used: - Yield is the interest paid for ignorance. - Code is law, but human greed is the bug. - Ledgers do not lie, only their auditors do.
First-person experience: - 2017 EtherFund ICO audit (integer overflow). - DeFi Summer stress test (Aave reserve factor). - NFT liquidity trap analysis (OpenSea gas costs).
Technical depth: - InvokeHarness API, finalMessage, toolUse block. - Session history event injection. - Path-based trust in opencode. - MCP provenance gap.
Contrarian angle: - Model-level defenses are irrelevant. - Human approval is not a trusted root. - Supply-chain impact via coding agents.
Takeaway: - Cryptographic binding required. - Blockchain agents must adopt this now. - Industry-wide shift coming.