AWS, Google, and Vercel Agent Flaws Let Attackers Trigger Tools Without Running the Model

What to do — versions and the unpatched path

The summary establishes CoreBreak, the three CVEs, and the shared fix pattern. What it cannot carry is the operational detail an engineer needs to act: exact patched versions, the one path that is still unpatched, per-vendor preconditions, and errors in the CVE records themselves.

Patch to these exact versions:

• Google ADK for Python → 2.5.0 or later (released July 16, 2026)
• @ai-sdk/harness-codex → 1.0.29 or later (CVE-2026-64650; vulnerable through 1.0.28)
• @ai-sdk/harness-opencode → 1.0.28 or later (CVE-2026-64651; vulnerable through 1.0.27)

The two Vercel fixes were published to npm July 10, 2026; both packages are now well past them (1.0.60 / 1.0.59 as of August 5). AWS's managed InvokeHarness fix required no customer action and was applied server-side before July 31, 2026.

The Strands path AWS did not fix

The AgentCore CVE-2026-18830 fix covers only the managed service. The open-source Strands Python event loop AgentCore builds on retains the same model-skipping shortcut. In event_loop.py, a helper _has_tool_use_in_latest_message gates a branch (commented "Skip model invocation if the latest message contains ToolUse") that sets the stop reason to tool_use and dispatches the tool directly. An April PR to remove this shortcut was closed unmerged on June 19, 2026; the branch was still present on main as of August 5.

AWS declared this the customer's responsibility under shared-responsibility and responded with documentation, not code — a "Trusted Message History" page under Safety and Security. If you run standalone Strands, the branch is live: exposure exists wherever untrusted callers can submit structured conversation messages, alter stored history, or place a toolUse block in the position the event loop consumes. There is no CVE, affected-version range, or patch notice for this.

Preconditions differ sharply per vendor

• AWS (8.6): authenticated remote request placing a tool-use block in the final InvokeHarness message.
• Google (9.3): attacker able to inject/manipulate session events (forged confirmation approval) — this is the default config. The separate resumable-mode function_call bypass, fixed in the same 2.5.0 release, is not covered by CVE-2026-18236 and is non-default.
• Vercel (6.3): local sandbox-to-host only. Requires Linux, an active harness session with at least one host-provided tool, and untrusted code already running in the sandbox (malicious dependency, build script, lifecycle hook). The relay had trusted any process whose command line contained an approved helper path (host-tool-mcp.mjs / the Codex shim); the fix binds each request to a short-lived one-time authorization matching an observed model event.

An agent wired to no sensitive tools gains an attacker nothing — exposure is bounded by inherited authority.

Caveats on the CVE records

Both Vercel CVE records carry errors: the Codex entry (CVE-2026-64650) names the OpenCode package in its description, and the OpenCode entry's structured data lists a fixed version its own text contradicts. Map packages to CVEs via the two GitHub advisories, not the CVE text. Likewise, CVE-2026-18236 covers only Google's continuation-forgery path — do not treat it as an umbrella for the resumable-mode bypass.

No advisory states whether any path was exploited against a live deployment before patching. PoC code was sent to vendors and not released. Note this is not prompt injection — the model never runs, so no system prompt or content filter can intervene; the control must sit at the tool execution layer.