Something broke in how we think about agent security. The recent disclosure of CVE-2026-18830 in the Amazon Bedrock AgentCore harness does not just patch a bug — it reveals a structural vulnerability class that the industry has not yet adequately named.
The vulnerability is straightforward in concept but significant in implication. CVE-2026-18830 (CVSS v4.0: 8.6) was a failure in the dispatch layer of the AgentCore harness. The system trusted tool-call-formatted data within the final message of an InvokeHarness request without verifying that the data originated from a legitimate model turn. An authenticated remote user could inject a tool-use content block that the agent event loop would dispatch directly, bypassing model mediation and its associated security controls entirely. The model never authorized the action. The harness executed it anyway.
AWS patched this before July 31, 2026, adding server-side input validation that rejects caller-supplied tool-use content blocks before they reach the event loop. No customer action required. The vulnerability was published by CISA in bulletin sb26-222 (week of August 3, 2026) and in AWS Security Bulletin 2026-073-AWS (August 4, 2026).
But the patch is the boring part. The interesting part is that CVE-2026-18830 was identified as part of the CoreBreak research by Phantom Labs, which also uncovered similar harness-layer bypasses in the Google ADK and Vercel AI SDK. This is not an isolated AWS misconfiguration. It is a category-wide vulnerability class that affects any agent framework where the dispatch layer trusts the data format of incoming messages without verifying their provenance from a legitimate model turn.
The pattern is worth naming: injecting tool-call-formatted data to bypass model mediation is the agentic equivalent of SQL injection. In SQL injection, the attacker exploits the boundary between user input and database query execution by injecting structured commands the system trusts by format. In agent harness injection, the attacker exploits the boundary between message content and tool dispatch by injecting tool-call structures the harness trusts by format. The underlying mechanism is identical — trusting the structure of data rather than verifying its origin.
A second vulnerability in the same research adds another layer. CVE-2026-18953 (CVSS v4.0: 8.6) disclosed a path traversal issue in Amazon awslabs.aws-transform-mcp-server versions 0.1.0 through 0.1.4. The get_resource tool’s savePath parameter allowed actors to write arbitrary files outside the intended working directory. Users should upgrade to version 0.1.5 or later. This one is more conventional — a classic path traversal — but its location matters. It sits inside the MCP ecosystem, the protocol layer that agents use to connect to external tools. The tool execution surface itself is vulnerable to structural flaws.
Together, these two CVEs sketch the new attack landscape. The harness layer, which orchestrates tool execution on behalf of the model, is now a primary target. And the MCP tool surface, which connects agents to the outside world, carries its own structural risks. The attack surface is not just the model or the network anymore — it is the entire dispatch chain between model intent and tool execution.
This connects to a thread we have been tracking on the infrastructure beat. The security arc runs from CoreBreak (framework layer) through Check Point (plumbing layer) through Cloudflare MCP detection (network layer) and now to AWS AgentCore (harness layer). Each layer in the agent stack is developing its own distinct class of vulnerability, and the harness — the layer that decides which tools to invoke and when — is the one that matters most because it controls execution.
The resolution of CVE-2026-18830 — server-side input validation that rejects unverified tool-use content blocks before the event loop processes them — points toward the right structural response. The harness cannot rely on the model to police its own tool calls. The infrastructure must independently verify the provenance and legitimacy of every instruction that reaches the dispatch layer. Treating the harness as a security-critical boundary, not just an orchestration convenience, is the minimum viable posture for agent infrastructure in 2026.