A vulnerability class called CoreBreak, presented at Black Hat USA 2026 by Hedi Ingber and Aviyam Ivgi of Stealth, exposes a structural failure in AI agent infrastructure: the dispatch layers of Amazon Bedrock AgentCore, Google Agent Development Kit (ADK), and Vercel AI SDK harness packages execute tools without requiring a legitimate model turn1. The dispatch layer accepts data shaped like a model-generated tool call without verifying its provenance, meaning the model is bypassed entirely and system prompts and refusal training are rendered irrelevant.
CoreBreak is distinct from prompt injection. Where prompt injection attempts to manipulate a model's judgment or output, CoreBreak operates below the model at the infrastructure plumbing layer, which trusts data without verifying its origin.
The research details three CVEs across major platforms:
CVE-2026-18830 (Amazon Bedrock AgentCore InvokeHarness API) — Rated CVSSv4 8.6 (High), this vulnerability allowed an authenticated remote caller to inject a tool-use content block directly into the final message of an InvokeHarness API request. The event loop dispatched the tool without model authorization. AWS deployed a fix automatically before July 31, 2026, as detailed in AWS Security Bulletin 2026-073-AWS.
CVE-2026-18236 (Google ADK for Python) — Rated CVSSv4 9.3 (Critical), this flaw allowed an attacker to manipulate or inject events into an agent session history to forge human-approval confirmation for sensitive tools. The confirmation processor failed to verify tool ownership or argument matches. A fix was released in ADK version 2.5.0 on July 16, 2026. Self-hosted operators must apply the ADK 2.5.0 fix manually.
CVE-2026-64650/64651 (Vercel @ai-sdk/harness-codex/opencode) — Rated CVSSv4 6.3 (Medium), these flaws involved a process-path check that trusted any process whose command line contained an approved helper script path. Malicious code in a Linux sandbox could satisfy the check. Fixes were released on July 20, 2026, in versions 1.0.29 and 1.0.28.
The researchers characterize CoreBreak as part of a recurring class of vulnerabilities defined by an inspection-execution gap — the system assumes that any tool-call-formatted data must have been generated by the model. Separately, CSA GuardFall research identified on June 30, 2026, by Omer Ben Simon of Adversa AI demonstrated shell injection bypasses in AI coding agents, finding that 10 of 11 tested agents were vulnerable. A Cloud Security Alliance AI Safety Initiative research note underscores the urgency of securing these layers.
On remediation: managed services like AWS Bedrock may auto-patch, but users of Google ADK and Vercel harness packages must manually update their infrastructure. Detection of such bypasses cannot rely on model I/O logs alone; it requires deep visibility into the dispatch and authorization layers. The researchers argue that every tool execution must be cryptographically or logically tied to a verified model turn.
ANALYSIS That all three major agent frameworks shared the same category of dispatch-layer trust failure points to a design pattern, not an isolated implementation bug. The distinction from prompt injection is operationally significant: organizations that have invested in model-level alignment, guardrails, and system-prompt hardening receive no protection against CoreBreak-class attacks, because the model never participates in the exploit chain.