The narrative is seductive. AI agents, equipped with large language models, are supposed to be the next frontier of automation. They reason, they plan, they execute. But what if the very infrastructure that carries their decisions is not a neutral pipe, but a backdoor?
On July 31, 2026, the coordinated disclosure of three CVEs—CVE-2026-18830 (AWS Bedrock AgentCore), CVE-2026-18236 (Google ADK for Python), and CVE-2026-64650/64651 (Vercel @ai-sdk/harness-codex/opencode)—exposed a structural flaw that transcends individual vendors. The CoreBreak research, conducted by Stealth and presented at Black Hat, did not find a simple prompt injection. It found a systemic assumption: the agent scheduling layer trusts the shape of data, not its origin. And that assumption is lethal.
Context
Let me step back. In 2024, I audited the custody solutions for the spot Bitcoin ETFs. I found single points of failure in multi-signature architectures. The lesson was simple: trust the verification, not the wrapper. Today, the same lesson applies to AI agents. The market has rushed to build agent frameworks—AWS Bedrock, Google ADK, Vercel AI SDK—each promising secure, autonomous execution. The common denominator? A scheduling layer that receives tool call blocks from the model and executes them. The assumption is that if the block looks like a valid tool call, it must have come from the model.
This is the CoreBreak. The research team proved that the assumption is false. An attacker can inject tool call blocks directly into the scheduling layer, bypassing the model entirely. The model-level defenses—system prompts, refusal training, alignment—are never invoked. The attack is not on the model; it is on the pipe. And the pipe is unprotected.
Core
Let me dissect three cases.
First, AWS Bedrock AgentCore (CVE-2026-18830, CVSS 8.6). The InvokeHarness API accepts a final message that can contain tool use content blocks. The scheduler does not verify whether these blocks originated from a model inference round. An authenticated remote caller can inject arbitrary tool calls. The model's guardrails are irrelevant because the injection bypasses the model entirely. According to the disclosure, AWS applied an automatic fix for all customers by July 31. But the question remains: before the fix, how many agents were executing tool calls that were never approved by the model?
Second, Google ADK for Python (CVE-2026-18236, CVSS 9.3). This is the most dangerous. The agent framework allows manipulation of session history to forge human approval for sensitive tool executions. The confirmation handler does not verify that the approval event corresponds to the actual tool invocation. An attacker can inject a fabricated 'human confirmed' event into the history, and the scheduler will execute the tool as if a human had approved it. The entire 'human-in-the-loop' security narrative is structurally negated. The fix was released in version 2.5.0, but self-hosted users must apply it manually.
Third, Vercel SDK (CVE-2026-64650/64651, CVSS 6.3). The process path check trusts any process whose command line contains an approved helper script path. Malicious code running in a Linux sandbox can satisfy the check by including the approved path in its invocation. The scheduler then grants the process elevated privileges. The fix requires manual update to version 1.0.29 or 1.0.28.
The common thread is what I call the 'inspection-execution gap'. The scheduler inspects the data shape—does it have the correct fields? Is the path a string? Does the event look like a human approval?—but it does not verify the data provenance. Every tool call must be cryptographically or logically bound to a verified model inference round. Without that, the scheduling layer is a blind execution conduit.
This is not a new problem. In 2020, I audited Curve Finance's stableswap invariant. The rounding errors were exploitable because the system trusted the input parameters without verifying their calculation path. The same pattern: shape over origin. The ledger does not forgive.
The GuardFall research, published by Adversa AI, corroborates this. They tested 11 AI coding agents for shell injection resilience. 10 were vulnerable. The attack surface is not limited to three vendors. It is industry-wide. The scheduling layer of any agent framework that trusts tool call blocks without provenance is vulnerable.
Contrarian
Let me give the bulls their due. The fixes are in place. AWS applied automatic updates. Google and Vercel shipped patches within days. The CVSS scores are high, but the attack vectors are constrained. For AWS, the attacker must be an authenticated remote caller—not anonymous. For Vercel, the attacker must have code execution within the sandbox. The exploitability is not trivial.
Furthermore, the model-level defenses are not entirely useless. They protect against the vast majority of prompt injection attacks. CoreBreak is a specific, sophisticated attack on the plumbing layer. The average agent deployment may never face this threat. The market reaction has been muted. No major customer losses or service disruptions have been reported.
But this is a false comfort. The structural flaw remains in every framework that does not enforce provenance binding. The patches are reactive, not proactive. The industry has not addressed the root cause: the scheduling layer's trust model is fundamentally broken.
Takeaway
Code is law. Logic is lethal. The CoreBreak vulnerabilities are not bugs; they are architectural errors. The assumption that data shape equals data origin is a design flaw that will surface again, in new frameworks, with new CVEs. The only solution is to embed cryptographic provenance into every tool call execution. Until then, every AI agent is a potential execution proxy for attackers.
Follow the coins, not the claims. The ledger does not forgive. Verification precedes trust.
The question is not whether your agent is secure. The question is whether your scheduling layer will betray you. The answer, today, is yes.