Hook
CVSS 9.3. That's not a model jailbreak. That's a direct injection into the execution layer — and it doesn't even need to touch the LLM. The anchor dropped, but I was already airborne. When I saw the CoreBreak disclosure, I didn't read the whitepaper. I read the CVSS scores and the attack vectors. Three different platforms. Three different CVEs. One common root cause: the scheduling layer trusts data shape, not data source. AWS Bedrock AgentCore, Google ADK for Python, Vercel AI SDK — all vulnerable to the same architectural blind spot. Model-level defenses? Useless. System prompts? Bypassed. Human-in-the-loop? Forged. This isn't a bug. This is a structural failure of the entire AI agent infrastructure stack.
Context
CoreBreak refers to a coordinated vulnerability disclosure by an independent security research team (Stealth) covering three critical flaws in leading AI agent orchestration frameworks. The vulnerabilities were disclosed in July 2026, with patches released by affected vendors. The common thread: agent schedulers accept tool call payloads without verifying that they originated from a legitimate model inference round. Attackers can inject malicious tool calls directly into the agent's execution pipeline, bypassing all model-level guardrails. This includes forging human approval confirmations (CVE-2026-18236, CVSS 9.3), injecting arbitrary tool use blocks into the final message (CVE-2026-18830, CVSS 8.6), and exploiting process path validation weaknesses (CVE-2026-64650/64651, CVSS 6.3). The research was presented at Black Hat and cited by the Cloud Security Alliance's AI security initiative. In parallel, the GuardFall study (Adversa AI) showed that 10 out of 11 AI coding agents are vulnerable to shell injection through similar scheduling-layer bypasses. The industry is facing a supply-chain level security crisis, and the market hasn't priced it in yet.
Core
Let me break down the technical anatomy. I've been auditing smart contracts since 2020 — DeFi Summer taught me that the code that runs the market is the market. The same principle applies to AI agents. The scheduling layer is the new smart contract, and it's full of trust assumptions that would make a DeFi auditor weep.
Case 1: AWS Bedrock AgentCore (CVE-2026-18830). The InvokeHarness API accepts a final message from an authenticated remote caller. The scheduler checks the shape of the content blocks — is it a valid tool use block? Yes. Does it match the expected schema? Yes. Execute. But it never checks whether that block actually came from the LLM's inference output. An attacker with a valid API session can inject a fake tool call that the agent will execute with full permissions. The model's system prompt and refusal training are irrelevant because the attack never touches the model. Speed is the only asset that doesn't depreciate — and here, the speed of the attack vector is faster than any model-level defense.
Case 2: Google ADK for Python (CVE-2026-18236). This one is worse. The ADK maintains a session history of events — user messages, model responses, tool calls, human approvals. An attacker can inject or manipulate events in that history. Specifically, they can forge a 'human approval' event for a sensitive tool call. The confirmation handler trusts the event source without verifying that the approval actually came from a human interface. CVSS 9.3 — critical. The entire 'human in the loop' safety narrative collapses. I don't trust humans, I trust code. But here, the code didn't even try to verify the trust chain.
Case 3: Vercel AI SDK (CVE-2026-64650/64651). The vulnerability is in the process path security check for tool execution. The SDK trusts any process whose command line contains a path to an approved helper script. In a Linux sandbox, an attacker can execute a binary with a crafted path that matches the check — e.g., creating a symlink that includes the approved string. The scheduler then grants that process elevated privileges. This is a classic injection-by-name, and it's been around since the days of shell injection. Yet it's still present in a modern AI SDK.
What's the common pattern? The scheduler assumes that any data shaped like a tool call must have been generated by the model. This is a fundamental failure of the inspection-execution gap. The system inspects the data format, but not the data provenance. During my DeFi Summer audit days, I learned one thing: trust boundaries are the first to fail. Every flash loan is a mirror reflecting greed. Here, the greed is for speed — shipping features before verifying origins.
Contrarian
The market narrative around AI safety has been dominated by model alignment: RLHF, constitutional AI, red-teaming prompts. Investors pour billions into companies that promise 'safe models'. But CoreBreak reveals a dirty secret: the model is not the weakest link. The infrastructure is. Even if you have the most aligned model in the world, an attacker can bypass it entirely by injecting a fake tool call into the scheduling layer. The model never sees the attack. The defense never deploys.
Chaos is just a pattern waiting for a faster eye. The pattern here is that the industry is repeating the same mistakes that plagued early DeFi: trusting that data arriving at a contract is authentic, without cryptographic verification. In DeFi, we learned that oracles must be decentralized and verified. In AI agents, the equivalent 'oracle' is the scheduling layer. And it's completely unverified.
The contrarian angle: the winners in this new landscape will be the platforms that can provide cryptographically verified execution chains — not the ones with the best model. AWS's automatic patching is a step, but it's reactive. The real innovation will come from startups that build 'agent firewalls' — middleware that validates tool call provenance using model-inference signatures. I've seen this movie before. In 2022, during the Terra collapse, I watched smart money accumulate LUNA while retail panicked. The same principle applies here: smart money will move to secure agent runtimes while retail FOMOs into vulnerable platforms. The market will eventually price in these security costs, but only after a few high-profile exploits.
Takeaway
For traders, the signal is clear. Shift focus from model-centric AI investments to infrastructure security. Watch for startups that provide runtime verification for AI agents — these are the next Chainlink or OpenZeppelin. Be cautious of self-hosted AI agent frameworks from Google and Vercel; they carry operational risk that the market hasn't yet discounted. The anchor hasn't dropped yet for the AI agent security market, but I'm already airborne. The question is: are you long on secure execution, or short on trust assumptions?