Every security team deploying AI agents has been told the same reassuring story: the model itself is the safety fence. Give the agent tools, yes — but rely on the language model's system prompts, content filters, and refusal training to decide whether each tool call is appropriate. The model, the logic goes, is the guard. At Black Hat USA 2026, researchers Hedi Ingber and Aviyam Ivgi of the firm Stealth dismantled that assumption with a named attack class they call CoreBreak — a set of structural flaws that let an attacker's instructions reach an agent's tools without any legitimate model turn ever executing.
When the model never runs, every model-level guardrail has nothing to intervene in. The system prompt is never consulted. The content filter never fires. The refusal training never produces a refusal, because the decision point was silently skipped. The results affect production infrastructure from Amazon Web Services, Google, and Vercel.
The Broken Assumption Behind Agentic AI
Under the hood, an AI agent is a chain of steps: a model receives input, decides it wants to use a tool, emits a tool-call instruction, and an execution layer (the "harness" or "dispatch layer") carries it out. Most security thinking assumes those two final steps are connected — that a tool call is executed because the model authorized it.
CoreBreak attacks exactly that assumption. The researchers found that in several orchestration layers, the runtime accepted data shaped like a model-generated tool call and dispatched it as though a legitimate model had produced it — without ever verifying provenance. The data could arrive from a caller-authored message, manipulated session history, a forged continuation, or an untrusted process already running inside a sandbox. The runtime saw the right shape and treated it as sufficient authority.
Three Vendors, Three Distinct Paths, Five CVEs
CoreBreak spans five vulnerabilities across three products. Each path is different, but all share the same structural weakness.
Amazon Bedrock AgentCore — CVE-2026-18830 (CVSS 8.6)
In Amazon's managed Bedrock AgentCore service, insufficient input validation in the InvokeHarness API allowed an authenticated remote user to place a tool-use content block in the final message of a request. The event loop then dispatched the named tool directly, without invoking the model at all. Anyone with API credentials could instruct the agent to run any tool in its configured set, bypassing whatever the model might have decided. AWS fixed the managed service automatically.
Google ADK for Python — CVE-2026-18236 (CVSS 9.3)
Google's Agent Development Kit (ADK) for Python before version 2.5.0 suffered what researchers describe as a continuation forgery. ADK lets developers flag sensitive tools as requiring human confirmation, holding the call until a person approves it. The confirmation processor, however, did not verify target-tool ownership, whether confirmation was actually required, or that the tool name and arguments matched the recorded call. An attacker able to inject events into an agent's session history could forge a confirmation for a sensitive tool, effectively overriding the human-approval gate.
Vercel AI SDK Harnesses — CVE-2026-64650 & CVE-2026-64651 (CVSS 6.3 each)
Vercel's harness packages for the Codex and OpenCode coding agents trusted a process based on command-line path checks. Because of that trust, untrusted code already running inside a Linux sandbox could invoke tools exposed on the host — such as secret lookups, deployment operations, and cloud API calls — without a corresponding model-authorized event. The relay assumed that a process reached in a certain way was safe, and authorized it without requiring proof of a model turn.
What CoreBreak Actually Enables
The impact is best understood as bypassing every control layer an organization thinks it has:
- Guardrail bypass: system prompts, content filters, and refusal training are structurally irrelevant, because no model decision occurs.
- Confirmation bypass: sensitive tools meant to pause for human approval can be triggered without that approval.
- Sandbox escape escalation: in the Vercel paths, untrusted sandbox code reaches host-exposed tools that were assumed isolated.
- Confidentiality, integrity, and availability: depending on which tools are exposed, attackers could read secrets, alter state, run operations, or disrupt workloads.
Importantly, the research notes that exposure is bounded by what each agent can already do. An agent configured without access to sensitive tools offers little to an attacker. But an agent wired into cloud APIs, secrets, and deployment pipelines — precisely the kind of agent organizations are building — becomes a powerful unauthenticated assist for whoever can shape its input.
Fixes and Remediation
All three vendors shipped fixes:
- AWS patched the managed Bedrock AgentCore service automatically (no customer action required for the managed side).
- Google fixed ADK for Python in version 2.5.0 and later.
- Vercel patched
@ai-sdk/harness-codexin version 1.0.29 and@ai-sdk/harness-opencodein version 1.0.28, removing the process-path fallback and requiring short-lived, one-time authorization bound to a model event.
Security teams should go further than updating and re-examine how they verify agent actions:
- Upgrade immediately to ADK 2.5.0+ and the patched Vercel harness versions; confirm AWS applied the managed fix.
- Audit the dispatch layer, not the model logs. CoreBreak detection requires visibility into tool-execution events, because an attack that skips the model never appears in model interaction logs.
- Bind authorization to effect. Require that authorization for a tool call be bound to an argument digest, so the values approved are the values executed.
- Least privilege for tools: keep agents from accessing secrets and high-impact cloud operations unless explicitly needed.
- Sandbox with real boundaries: do not trust process path checks; isolate tools and host surfaces from any code that can run in a sandbox.
- Monitor for tool calls without model events — a telltale sign of a CoreBreak-style bypass.
The Lesson: Guardrails Belong at the Execution Layer
CoreBreak is the clearest evidence yet that the security boundary in agentic AI is moving from the model to the infrastructure that brokers model decisions. The industry has spent enormous effort hardening models against prompt injection and refusal bypass, only to discover that the runtime layer could be tricked into executing tools the model never chose — and in some paths, the model never even had a say.
Organizations must stop treating the model as the perimeter. Authorization must be verified at the execution layer, bound to the specific effect requested, and auditable independently of model logs. The era of assuming "the model will be the safety fence" is over — CoreBreak proved the fence was never where the attacker was standing.
Technical sources: CSA Cloud Security Alliance research note, The Hacker News, Stealth researcher disclosure at Black Hat USA 2026, and vendor CVEs (CVE-2026-18830, CVE-2026-18236, CVE-2026-64650/64651).