CoreBreak is the name security researchers have given to a new attack pattern affecting the AI agent infrastructure of three major companies: Amazon Web Services (AWS) , Google , and Vercel . The vulnerabilities allowed unauthorized or forged commands to reach an agent’s tools without verification by the AI model — and in several attack scenarios, the model wouldn’t execute at all, bypassing system prompts, content filters, and guardrails entirely.
See also: Android: What's new in Google's June 2026 system updates
The affected products include the Amazon Bedrock AgentCore InvokeHarness API , the Google Agent Development Kit (ADK) for Python, and the Vercel AI SDK harness packages for the Codex and OpenCode coding agents . AWS has already patched the managed service, Google addressed the issues in ADK 2.5.0 , while Vercel patched @ai-sdk/harness-codex to version 1.0.29 and @ai-sdk/harness-opencode to version 1.0.28 . The vulnerabilities were disclosed by Hedi Ingber and Aviyam Ivgi , co-founders of Stealth , at Black Hat USA 2026. As for CoreBreak ,
In a typical AI agent flow, the SDK sends the user request, system prompt, chat history, and definitions of available tools to the model. The model decides whether to invoke a tool and returns a structured command with the tool name and arguments. The SDK then executes the command. The vulnerable paths did not verify the origin between the last two steps: the runtime received data that looked like a tool command from the model and treated it as authentic, without checking whether it actually came from it. In relation to CoreBreak,
CoreBreak: Technical details of CVEs for AWS, Google and Vercel
AWS has released CVE-2026-18830 with a CVSS v4.0 score of 8.6 , which concerns insufficient input validation in the Amazon Bedrock AgentCore harness . An authenticated remote user could place a tool-use content block in the last message of an InvokeHarness request, allowing the event loop to directly execute the tool without consulting the model. AWS implemented server-side validation that rejects caller-supplied tool-use blocks before they reach the event loop — the fix was applied automatically and requires no action from customers.
However, the managed service fix does not address a similar model bypass path in the open-source Strands Python framework , which is based on the AgentCore harness . The current event_loop.py calls a helper function _has_tool_use_in_latest_message , and when this check passes, the event loop sets the break reason to tool_use , directly fetches the latest message, and skips model execution. A comment in the code explicitly states that the model call is skipped if the latest message contains ToolUse . This path is confirmed to remain in the main branch of the repository as of August 5, 2026 . An April pull request had warned that externally injected toolUse blocks could reach tool execution without a model invocation, but was closed without merging on June 19 . The CoreBreak case
For Google, CVE-2026-18236 received a CVSS v4.0 score of 9.3 — the highest of the three cases. The attack paths required attacker-controlled session events or user-generated function calls, which could forge a confirmation for a sensitive tool that was supposed to require human approval. This is particularly dangerous, as confirmation gates are often the last line of defense before a critical action. Regarding CoreBreak,
For Vercel , CVE-2026-64650 and CVE-2026-64651 each received a CVSS v4.0 score of 6.3 . The flaws affected the harness packages for the coding agents Codex and OpenCode , respectively. The relay trusted a process based on command-line path checks, so untrusted code already running inside a Linux sandbox could invoke tools exposed on the host without a corresponding model-authorized event. Specifically, it used a process-name/path heuristic via /proc on Linux, allowing malicious code inside the sandbox to impersonate an authorized helper and gain access to host tools. In the context of CoreBreak ,
See also: PCPJack: Attack on 230 AWS, Google Cloud and Azure cloud servers
CoreBreak and the broader threat landscape for AI agents
The CoreBreak disclosure is part of a broader wave of research in 2025-2026 showing that AI agents often mix model reasoning, conversation state, and tool execution in ways that are difficult to secure. Similar findings have been reported across multiple platforms: Wiz reported GhostApproval , a systematic trust boundary weakness in multiple AI coding assistants, where malicious repositories could allow agents to access files outside of the workspace sandbox, potentially leading to RCE or credential theft. Microsoft AutoGen Studio also allowed untrusted web content to reach the local MCP infrastructure and spawn arbitrary host processes.
The Microsoft Semantic Kernel Python SDK was affected by CVE-2026-26030 and CVE-2026-25592, which were described as critical prompt injection leading to RCEs on production agent hosts. Additionally, the AWS AgentCore Code Interpreter had network isolation bypasses, and AWS separately issued CVE-2026-12530 for an incomplete blocking in the install_packages() function that could allow command injection within the sandbox. A related prompt injection, CVE-2026-18733, is also reported as a shell tool bypass where crafted input sets non_interactive=true to bypass a human consent gate and allow arbitrary OS command execution. The CoreBreak
The key security takeaway from the AWS , Google , and Vercel revelations is that tool authorization should not be inferred from conversational or process metadata. Wiz ’s research into AI agent trust limits suggests that many agent products still fail to enforce canonical-path checks, strong sandbox boundaries, and least-privilege tool access, allowing attacker-controlled content to lead the agent to take privileged actions. According to The Hacker News , the exposure is limited by what each agent can already do — an agent without access to sensitive tools provides no advantage to an attacker. As for CoreBreak ,
How to protect yourself from CoreBreak and similar AI agent attacks
Organizations using AI agents or harnesses should take immediate action. First, treat conversation history, session events, and confirmations as untrusted input unless they are cryptographically or otherwise strongly bound to a verified model turn. Second, require accurate, unique authorization tokens for each tool invocation, mapped to the tool name and arguments, rather than relying on process names, prompt text, or session state.
Additionally, it is critical to isolate the sandbox from the host tools so that code already running in the sandbox cannot directly invoke privileged actions on the host. The principle of least privilege should be applied to every tool, connector, OAuth grant, and workspace integration. In terms of updates, users should immediately upgrade: Google ADK for Python to version 2.5.0 or later, Vercel harness packages beyond the affected versions, and AWS components that include the corrected AgentCore harness. Regarding CoreBreak,
See also: Google Chrome update fixes 79 security vulnerabilities
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Finally, organizations should assume that prompt injection can bypass agent intent checks and add defense-in-depth controls, such as allowlists, human review for high-risk actions, audit logs, and network and file system segmentation. Separating generation from execution — so that an LLM cannot directly execute highly privileged commands in the same trusted runtime — is a fundamental principle of secure AI agent design that many platforms still do not adequately implement.
