ANALYSIS The wave of agentic AI vulnerabilities disclosed in recent weeks reveals a structural truth the industry has been slow to internalize: the most consequential security failures in AI agent systems are not happening at the model layer — they are happening in the dispatch loops, command allowlists, and API harnesses that sit beneath it.
Why it matters
Gartner estimates that 40% of enterprise applications will integrate task-specific agents by the end of this year, up from less than 5% in 20251. IDC projects full agentic AI deployment across the enterprise by 2027. ◆ That adoption curve is colliding with a vulnerability class that model-level alignment, prompt hardening, and output filtering cannot address — because the exploits never touch the model at all.
The big picture
The CoreBreak research, presented at Black Hat USA 2026 by Hedi Ingber and Aviyam Ivgi of Stealth, identifies a structural failure across three major agent platforms: the dispatch layers of Amazon Bedrock AgentCore, Google Agent Development Kit (ADK), and Vercel AI SDK harness packages execute tools without requiring a legitimate model turn8. The dispatch layer accepts data shaped like a model-generated tool call without verifying its provenance. Because the system assumes any tool-call-formatted data is valid, the model is bypassed entirely, "rendering system prompts and refusal training irrelevant".
The CVE trail is concrete. CVE-2026-18830, affecting AWS Bedrock AgentCore's InvokeHarness API, was rated CVSSv4 8.6 (High)6. CVE-2026-18236, affecting Google ADK for Python, was rated CVSSv4 9.3 (Critical). CVE-2026-64650/64651, affecting Vercel @ai-sdk/harness-codex/opencode, were rated CVSSv4 6.3 (Medium). AWS deployed a fix automatically before July 31, 2026. Self-hosted operators using Google ADK and Vercel harness packages must manually update their infrastructure to mitigate these risks.
ANALYSIS Three platforms, three CVEs, one vulnerability pattern — and none of them fixable by improving the model itself. That is the defining characteristic of this moment.
Between the lines
The CoreBreak disclosures are not isolated. They sit alongside a parallel strand of evidence that command-level trust models are also failing. On August 18, 2026, Docker published an analysis warning that even when users approve seemingly safe commands from AI coding agents, arbitrary code execution remains possible4,5. Docker highlighted CVE-2026-22708, discovered in the AI code editor Cursor, which allowed environment variables to be rewritten without user confirmation. Attackers could exploit Git's PAGER variable so that when a user approves a harmless command like "git branch," malicious code executes in the background.
Docker argues that command-name-based allowlists cannot guarantee security. The company advocates isolating AI agents within microVMs using Docker Sandboxes to control credential and network access. Docker's position is that defense through limiting an AI agent's reach — rather than relying on its self-restraint — is the more effective approach.
The mid-reasoning data exposure problem compounds the risk. Every enterprise agent operates across three distinct data touchpoints — input, mid-reasoning, and output — and most existing controls are wrapped around the first and the last10. Detection of dispatch-layer bypasses cannot rely on model I/O logs alone.
The OWASP Top 10 for LLM Apps 2026 reflects this shift: excessive agency climbed the list, even as prompt injection and data disclosure remain concerns9. And the threat is not theoretical at the kernel level either — functional exploit code for CVE-2026-40369, a Windows kernel vulnerability, dropped three months after Microsoft's patch, with a 100% deterministic exploit chain that eliminates the skill floor typically associated with kernel exploitation3.
ANALYSIS Taken together, these strands describe a single strategic problem: the industry built agent security around the assumption that the model is the trust boundary. CoreBreak, Docker's allowlist failures, and the mid-reasoning blind spot all demonstrate that the actual attack surface sits in infrastructure layers the model never controls.
What's next
The CoreBreak researchers argue that every tool execution must be cryptographically or logically tied to a verified model turn. The Cloud Security Alliance AI Safety Initiative has underscored the urgency of securing these layers. Docker states that it is more useful to pre-define the range that an AI agent can reach than to try to accurately determine whether every instruction the AI agent reads is safe. ◆ Two distinct remediation approaches are now on the table — provenance verification at the dispatch layer, as CoreBreak researchers advocate, and microVM isolation, as Docker implements — each addressing a different segment of the attack surface the model itself cannot police.