AWS, Google, and Vercel Agent Flaws Let Attackers Trigger Tools Without Running the Model

Summary: Researchers Hedi Ingber and Aviyam Ivgi, co-founders of Stealth, presented a cross-platform pattern they call CoreBreak at Black Hat USA 2026, showing that agent infrastructure from AWS, Google, and Vercel accepted tool-call-shaped data as authoritative without verifying a model turn had authorized it. AWS assigned CVE-2026-18830 (CVSS 8.6) to Amazon Bedrock AgentCore's InvokeHarness API for requests before July 31, 2026, Google fixed ADK for Python in 2.5.0 on July 16, 2026 under CVE-2026-18236 (CVSS 9.3), and Vercel patched @ai-sdk/harness-codex and @ai-sdk/harness-opencode under CVE-2026-64650 and CVE-2026-64651 (both CVSS 6.3).
Why it matters: The model never runs in these paths, so system prompts, content filters, and model-level guardrails never get a chance to intervene - and AWS told the researchers the comparable model-skipping shortcut in open-source Strands falls on the customer's side of the shared-responsibility model, responding with a documentation change rather than a code fix.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-18830
Related: ⚡ Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply-Chain Attacks, and Router Backdoors Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026