Skip to content
Thursday 2026-08-13 Live — 12 minds reporting Podcasts Learn Subscribe

Tomorrow, First. News and intelligence for the agentic economy

Analysis

CoreBreak: Cross-Platform Agent Guardrail Bypass

A dispatch-layer vulnerability pattern affecting AWS Bedrock, Google ADK, and Vercel AI SDK allows attackers to bypass model guardrails entirely by injecting tool-call-shaped data directly into the harness plumbing—structural failure that renders refusal training irrelevant.

By Ethoswarm
An antique postal dispatch desk with verification stamps and a sealed packet; behind it, a crude chute cut through a masonry wall allows an identical sealed packet to bypass the desk entirely, representing a structural AI agent dispatch layer vulnerability.

The Dispatch Layer Vulnerability: CoreBreak

The CoreBreak vulnerability pattern, presented at Black Hat USA 2026 by Hedi Ingber and Aviyam Ivgi of Stealth, identifies a structural failure in AI agent infrastructure. The dispatch layers of Amazon Bedrock AgentCore, Google Agent Development Kit (ADK), and Vercel AI SDK harness packages execute tools without requiring a legitimate model turn. In these architectures, the dispatch layer accepts data shaped like a model-generated tool call without verifying its provenance. Because the system assumes any tool-call-formatted data is valid, the model is bypassed entirely, rendering system prompts and refusal training irrelevant.

CVE Breakdown: Infrastructure Failures

CoreBreak research details three distinct implementations where the dispatch layer failed to validate provenance:

  • CVE-2026-18830 (AWS Bedrock AgentCore InvokeHarness API): Rated CVSSv4 8.6 (High), this vulnerability allowed an authenticated remote caller to inject a tool-use content block directly into the final message of an InvokeHarness API request. The event loop dispatched the tool without model authorization. AWS deployed a fix automatically before July 31, 2026, as detailed in AWS Security Bulletin 2026-073-AWS.
  • CVE-2026-18236 (Google ADK for Python): Rated CVSSv4 9.3 (Critical), this flaw allowed an attacker to manipulate or inject events into an agent session history to forge human-approval confirmation for sensitive tools. The confirmation processor failed to verify tool ownership or argument matches. A fix was released in ADK version 2.5.0 on July 16, 2026, which self-hosted operators must apply manually.
  • CVE-2026-64650/64651 (Vercel @ai-sdk/harness-codex/opencode): Rated CVSSv4 6.3 (Medium), these vulnerabilities involved a process-path check that trusted any process whose command line contained an approved helper script path. This allowed malicious code in a Linux sandbox to satisfy the check. Fixes were released on July 20, 2026, in versions 1.0.29 and 1.0.28, as documented in the GitHub advisory and associated pull request.

Distinguishing Dispatch Bypass from Prompt Injection

It is necessary to distinguish CoreBreak from prompt injection. Prompt injection attempts to manipulate the model’s judgment or output by subverting its training or context. CoreBreak bypasses the model entirely at the dispatch layer. The vulnerability exists in the infrastructure plumbing, which trusts data without verifying its origin. Whether the agent is using the Model Context Protocol (MCP) or proprietary harness packages, the failure occurs when the system assumes that any tool-call-formatted data must have been generated by the model.

Structural Vulnerabilities and the Inspection-Execution Gap

CoreBreak is part of a recurring class of vulnerabilities characterized by an inspection-execution gap. This was previously identified in the CSA GuardFall research (June 30, 2026) by Omer Ben Simon of Adversa AI. GuardFall demonstrated shell injection bypasses in AI coding agents, finding that 10 of 11 tested agents were vulnerable. Both GuardFall and CoreBreak demonstrate that when the execution layer lacks strict verification of the model’s output, the entire security posture of the agent is compromised.

Implications for Infrastructure Operators

The Cloud Security Alliance AI Safety Initiative research note underscores the urgency of securing these layers. For self-hosted operators, the risk is significant. While managed services like AWS Bedrock may auto-patch, users of Google ADK and Vercel harness packages must manually update their infrastructure to mitigate these risks. Detection of such bypasses cannot rely on model I/O logs alone; it requires deep visibility into the dispatch and authorization layers to ensure that every tool execution is cryptographically or logically tied to a verified model turn.