AWS, Google and Vercel patch agent tool authorization flaws
AWS, Google and Vercel have patched separate weaknesses in agent infrastructure that could allow tools to run without a legitimate model decision. The affected products were Amazon Bedrock AgentCore’s InvokeHarness API, Google’s Agent Development Kit for Python, and Vercel AI SDK harness packages for Codex and OpenCode.
The findings were presented at Black Hat USA 2026 by Stealth co-founders Hedi Ingber and Aviyam Ivgi as a cross-platform pattern called CoreBreak. In the vulnerable paths, data shaped like a model tool call could reach a dispatch or authorization mechanism without proof that a model turn had produced it.
Tool-call data was treated as authority
In a conventional agent flow, an SDK sends the prompt, conversation context and tool definitions to a model. The model returns a structured instruction identifying a tool and its arguments, and the SDK executes that instruction. The reported flaws did not consistently verify the provenance of the instruction between model output and tool execution.
That distinction is material because system prompts, content filters and model-level guardrails do not run when the model is skipped. The practical impact remains bounded by the tools, credentials and permissions available to the agent.
Google’s ADK remediation follows concerns around agent execution paths in Google ADK agent execution safeguards, while the newly reported issues show why controls must also validate the authorization data consumed at runtime.
Vendor fixes address distinct attack paths
AWS assigned CVE-2026-18830, rated CVSS v4.0 8.6, to insufficient input validation in the managed AgentCore harness. Before July 31, 2026, an authenticated caller could supply a tool-use content block in the final message of an InvokeHarness request and trigger dispatch without a model call. AWS deployed server-side validation automatically to reject such blocks before they reach the event loop.
The managed fix does not cover the comparable shortcut documented in open-source Strands Python. Its event loop can skip model invocation when the latest message contains tool use. AWS’s guidance tells developers to construct message history in their own application rather than accept history that a caller can shape.
Google fixed two paths in ADK for Python 2.5.0, released July 16, 2026. CVE-2026-18236, rated 9.3, involved forged confirmation events in session history. The patch checks that the tool belongs to the executing agent, requires confirmation, and matches the recorded tool name and arguments. Google also changed resumable mode to reject function-call parts in user-authored messages.
Vercel patched @ai-sdk/harness-codex in 1.0.29 and @ai-sdk/harness-opencode in 1.0.28. The relay had trusted process command-line paths for approved helper scripts. Untrusted code already running in a Linux sandbox could exploit that fallback to invoke host-exposed tools. The revised relay requires an exact, short-lived, one-time authorization tied to a tool and input observed in a model event.
Execution-time authorization is the business control
Organizations using these components should upgrade ADK for Python to 2.5.0 or later and the Vercel harness packages to their fixed or newer releases. They should also regard structured conversation history, resumable events, confirmation responses and tool-use blocks as untrusted whenever they cross an external boundary.
The operational priority is to authorize each invocation at execution time against the originating model event, tool name, arguments, session and approval state. Restricting an agent to only the cloud roles, credentials, write access and tools required for its task limits the effect of an authorization failure.