What is CoreBreak and why does bypassing the model matter?

CoreBreak is an attack class targeting the tool dispatch layer of AI agent frameworks. Instead of manipulating a model's output through prompt injection or jailbreaking, it triggers tool execution by directly crafting the event or message structures the agent runtime acts on — before the model has a chance to evaluate the request. Safety filters, content policies, and model-level authorization controls are all rendered irrelevant because the model never runs. Any tool the agent is configured to call can be invoked with attacker-controlled arguments.

Which CVEs are associated with CoreBreak and are they patched?

Three CVE clusters are associated with CoreBreak: CVE-2026-18830 (AWS Bedrock AgentCore InvokeHarness, CVSS 8.6) was patched on the managed service automatically. CVE-2026-18236 (Google Agent Development Kit for Python, CVSS 9.3) was fixed in ADK version 2.5.0 released July 16, 2026. CVE-2026-64650 and CVE-2026-64651 (Vercel @ai-sdk/harness-codex and @ai-sdk/harness-opencode, CVSS 6.3) were fixed in versions 1.0.29 and 1.0.28 respectively, released July 10, 2026. All managed and published package variants are patched. A residual exposure exists in the AWS Strands open-source Python library, addressed by documentation change rather than code fix.

Does CoreBreak require an existing compromise to exploit?

The attack surface varies by framework. In Google ADK's resumable-mode path, an attacker who can write content into the session event log — for instance, through a prompt injection that writes to agent memory, or through any tool that returns attacker-controlled structured data — can plant a function_call part that the runtime will dispatch on the next execution step. In the AWS Bedrock case, the attack requires access to the InvokeHarness API endpoint. For Vercel's sandbox variants, the attacker needed to control code executing inside the sandbox, but that code could then escape the sandbox's intended tool boundaries. The common thread is: exploitation happens at the framework layer, not through the model.

CoreBreak: AWS, Google, and Vercel Agent Flaws Bypass the AI Model Entirely

A class of vulnerabilities disclosed at Black Hat USA 2026 this week shows that AI agent guardrails can be bypassed entirely — not by convincing the model to produce dangerous output, but by routing tool execution around the model layer entirely. Researchers Hedi Ingber and Aviyam Ivgi from Stealth named the attack class CoreBreak and demonstrated working exploits against AWS Bedrock AgentCore, Google’s Agent Development Kit, and two Vercel AI SDK harness packages. All four products have shipped patches. A residual exposure in an AWS open-source library remains unpatched at the code level.

The Attack Concept

Most AI agent security thinking focuses on the model: preventing jailbreaks, filtering outputs, defending against prompt injection. CoreBreak targets a different layer — the event loop and tool dispatch machinery that sits around the model.

Agent frameworks follow a standard pattern: receive input, invoke the model, receive model output containing tool-use requests, dispatch those tool calls, feed results back. CoreBreak exploits frameworks where the tool dispatch step can be triggered without going through the model. An attacker who can influence the structured data the event loop reads — session state, message queues, API request bodies — can cause tools to execute with arbitrary arguments. The model never gets a turn. Its safety filters, authorization checks, and content policies are never consulted.

Ingber and Ivgi’s Black Hat presentation framed it directly: “This is not prompt injection. There is no probabilistic model to fool. There is no jailbreak threshold to cross — because the model never gets a turn.”

CVE-2026-18830: AWS Bedrock AgentCore

The AWS Bedrock AgentCore vulnerability (CVSS 8.6, CWE: improper input validation) exists in the InvokeHarness API, the endpoint through which external callers send messages to agent sessions.

The framework’s event loop checks the final message in the session for a tool-use content block. If one is present, the loop treats it as a pending tool dispatch and executes it immediately — on the assumption that a prior model turn must have generated it. The InvokeHarness API did not validate this assumption. An attacker with access to the endpoint could craft a message containing a tool-use content block and send it directly. On the next event loop iteration, the framework dispatched the embedded tool call without invoking the model.

Any tool available to the agent — file system access, API calls, code execution — could be triggered with attacker-specified arguments.

AWS patched the managed InvokeHarness endpoint automatically; no customer action was required for the hosted service. However, the same shortcut that enabled this behavior also appears in the AWS Strands open-source Python library for building agents. The Strands library includes a _has_tool_use_in_latest_message check that implements the same “skip model invocation if the latest message contains a ToolUse block” logic. A pull request submitted in April 2026 to remove the shortcut was closed without merging. AWS’s response to the CoreBreak disclosure addresses the Strands exposure with documentation guidance rather than a code change.

CVE-2026-18236: Google Agent Development Kit

The Google ADK vulnerability (CVSS 9.3, CWE-863: incorrect authorization) has two distinct exploitation paths, both in the Python implementation.

Session event confirmation bypass. ADK includes a tool confirmation mechanism designed to require explicit approval before sensitive tools execute. The confirmation state is stored in session events. Ingber and Ivgi discovered that an attacker who can write a forged approval record into the session event log — for instance, through a tool that stores agent-controlled content, or via prompt injection that reaches persistent memory — can pre-satisfy the confirmation check for any subsequent tool call. When the agent later encounters a tool requiring confirmation, the framework finds the forged approval in the event log and proceeds without presenting the confirmation prompt.

Resumable-mode function_call bypass. ADK’s resumable execution mode allows agents to pause mid-task and resume. When the agent resumes, the framework reads through session events for any pending function_call parts and dispatches them. This path trusted the content of existing session events without re-validating that they originated from a model turn. An attacker who can plant a function_call part in the session event store — again, potentially through any mechanism that writes to agent-accessible storage — can have it dispatched on the next resume cycle.

Google fixed both paths in ADK version 2.5.0, released July 16, 2026. The fix introduces source validation on session events, distinguishing model-generated tool requests from user or external content.

CVE-2026-64650 / 64651: Vercel AI SDK Harness Packages

Vercel’s two experimental harness packages — @ai-sdk/harness-codex and @ai-sdk/harness-opencode — exposed a process-path trust issue (CVSS 6.3, CWE-863). The packages are designed to let AI coding agents run code in a sandboxed subprocess while keeping some tools available only on the host process.

The trust boundary was enforced by checking the process path of the caller: host tools checked whether the invocation came from the host process or the sandbox. Code running inside the sandbox could forge this check by manipulating the process context, then invoke host-only tools directly — bypassing the intended isolation boundary. The model’s decision about which tools to use in which context was irrelevant; the sandbox code invoked host tools without any model involvement.

Vercel shipped fixes in versions 1.0.29 (harness-codex) and 1.0.28 (harness-opencode), released July 10, 2026. The fix moves the trust boundary from process-path checks to a cryptographic channel that sandbox code cannot forge.

A separate but related Vercel fix for tool-approval replay, shipped June 10, was credited to Anthropic’s Mythos team under Project Glasswing ahead of the CoreBreak research becoming public.

The Strands Open-Source Exposure

The most immediate residual risk from CoreBreak affects users of the AWS Strands Python library who have not reviewed their agent configurations. The _has_tool_use_in_latest_message shortcut in Strands is a direct analog of the Bedrock InvokeHarness vulnerability: if a session’s message history ends with a tool-use block — whether placed there by an attacker through prompt injection, a malicious tool response, or any writable storage path — the Strands event loop will dispatch that tool call on the next iteration without invoking the model.

Unlike the managed Bedrock fix, which was applied server-side automatically, Strands users must take their own action. AWS’s guidance is to audit agent code for direct message history manipulation and to avoid patterns that allow external content to appear as the final message in tool-use content block form. No code patch is currently available in the Strands library for this behavior.

What CoreBreak Means for Agent Defense

The agent security model that has received the most attention is prompt injection — attackers manipulating model inputs to alter model behavior. CoreBreak identifies a structurally different threat: the event loop and state management infrastructure that sits between the model and tool execution can itself be the attack surface.

Defenses against prompt injection — output filtering, model-level constitutional AI, fine-tuning for safety — are irrelevant when the model is excluded from the execution path. CoreBreak requires defenders to extend trust model thinking to the non-model components of agentic systems: the structures the event loop reads, the sources that can write to session state, and the validation logic that governs whether a tool dispatch originated from a model turn.

Frameworks that implement tool confirmation as a model-adjacent check, rather than as a cryptographic or out-of-band mechanism, are structurally vulnerable to variants of the Google ADK path. Frameworks that optimize agent startup by skipping model invocation when tool-use state is already present share the AWS Bedrock/Strands structure. Neither is an exotic design choice — both are natural performance and UX optimizations that become security assumptions once agents are given access to consequential tools.

The three-vendor scope of CoreBreak’s Black Hat disclosure reflects how early-stage the security engineering discipline around agent runtime design is. The vulnerabilities are not obscure edge cases — they are in the core dispatch logic of production frameworks used at scale.

Remediation Summary

Product	CVE	CVSS	Status	Action Required
AWS Bedrock AgentCore (managed)	CVE-2026-18830	8.6	Patched automatically	None
AWS Strands (open source)	—	—	Documentation only	Audit session message handling
Google ADK for Python	CVE-2026-18236	9.3	Fixed in ADK 2.5.0 (Jul 16)	Update to ≥ 2.5.0
Vercel @ai-sdk/harness-codex	CVE-2026-64650	6.3	Fixed in 1.0.29 (Jul 10)	Update to ≥ 1.0.29
Vercel @ai-sdk/harness-opencode	CVE-2026-64651	6.3	Fixed in 1.0.28 (Jul 10)	Update to ≥ 1.0.28