Tool Without a Model: How AWS, Google, and Vercel Let Attackers Hijack Agent Actions

Three major AI infrastructure providers just patched a class of vulnerabilities that had nothing to do with tricking a language model. In each case, attackers could trigger real tool executions without the model ever running. No jailbreak. No clever prompt. The model simply wasn't consulted.

Amazon Bedrock AgentCore, Google's Agent Development Kit for Python, and Vercel's AI SDK harness packages for Codex and OpenCode all contained flaws that allowed tool-call-shaped data to be treated as authoritative instructions, regardless of whether a model had actually generated them. Security researchers Hedi Ingber and Aviyam Ivgi, co-founders of a company called Stealth, presented the pattern at Black Hat USA 2026 under the name CoreBreak.

All three vendors have shipped fixes. AWS patched its managed InvokeHarness API by July 31. Google addressed its issues in ADK 2.5.0 on July 16. Vercel patched both harness packages on July 10.

The vulnerabilities are different in character, not variations on a single exploit.

How Agent Flows Are Supposed to Work

In a standard agent architecture, a request goes to the model along with the system prompt, conversation history, and tool definitions. The model decides whether to call a tool, returns a structured instruction, and the SDK executes it. The model's decision is the authorisation.

The vulnerable paths broke that chain. The runtimes received data formatted like a model-generated tool call and dispatched it without verifying that any model turn had actually produced it. An attacker who could inject the right shaped data into the right place could skip the model entirely, and with it, every guardrail, content filter, and system prompt instruction baked into it.

AWS: Fixed in the Managed Service, Unresolved in Open Source

CVE-2026-18830, scored 8.6 on CVSS v4.0, affected Amazon Bedrock AgentCore's InvokeHarness API. An authenticated remote caller could include a tool-use content block in the final message of a request. The event loop would then dispatch that tool directly, without asking the model what to do.

AWS applied server-side validation that drops caller-supplied tool-use blocks before they reach the event loop. Existing customers don't need to do anything.

The problem is that AgentCore's harness is built on Strands, AWS's open-source Python agent library, and the equivalent shortcut still lives in Strands. A function called `_has_tool_use_in_latest_message` in `event_loop.py` can cause the loop to skip model invocation entirely when a tool-use block is detected in the most recent message. The comment above it says, plainly: "Skip model invocation if the latest message contains ToolUse."

As of August 5, 2026, that branch is still in the main repository. A pull request filed in April explicitly warned that externally injected toolUse blocks could reach execution without model involvement, and proposed removing the shortcut. It was closed unmerged in June.

AWS's response to standalone Strands deployments was documentation, not a patch. A new page titled Trusted Message History explains that developers should build conversation history from their own application logic rather than from caller-supplied input. Fair enough as advice. Not a fix.

AWS told the researchers this falls on the customer side of the shared-responsibility model. Whether you agree depends on how much you think a framework should protect developers from a footgun it put in front of them.

Google: Two Flaws, One Release, One CVE

Google's ADK had two separate issues, both addressed in ADK 2.5.0.

The first, CVE-2026-18236 with a CVSS v4.0 score of 9.3, involved the human-in-the-loop confirmation feature. Developers can flag a tool as requiring manual approval before it runs. The confirmation processor failed to check whether the tool being confirmed actually belonged to the executing agent, whether it genuinely required confirmation, or whether the name and arguments matched the original pending call. An attacker who could inject or manipulate session events could forge a confirmation and execute tools that should have been gated.

The second issue was in resumable-mode flows. ADK accepted user-authored events containing function call parts, which the runtime interpreted as instructions to execute registered tools. That meant a user could bypass the model and call tools directly through crafted events. Google now rejects function calls appearing in user-authored messages.

Google assigned a CVE only for the first issue, on the basis that it affects the default configuration. Resumable mode is opt-in and newer. The researchers attribute both findings to their team. Developers using resumable mode should not assume CVE-2026-18236 covers their exposure.

Vercel: Sandbox Trust Was Too Loose

Vercel's flaws were local rather than remote. CVE-2026-64650 affected `@ai-sdk/harness-codex` through 1.0.28, and CVE-2026-64651 affected `@ai-sdk/harness-opencode` through 1.0.27. Both score 6.3.

The harness relay determined whether to trust a process based on whether its command line contained the path of an approved helper script. Malicious code already running inside the Linux sandbox could satisfy that check and invoke host-exposed tools, including secret lookups, cloud API calls, and deployment operations, without any corresponding model-authorised event.

This wasn't a remote attack. It required Linux, an active harness session with host-provided tools, and untrusted code already running in the sandbox, such as a malicious npm dependency or lifecycle hook. Not trivial, but well within realistic threat models for developer tooling that processes arbitrary repositories.

Vercel scrapped the process-path approach entirely. The patched relay now ties each request to a short-lived, one-time authorisation keyed to the specific model event, tool name, and input that generated it. Both fixed packages were published July 10. The packages have since moved to 1.0.60 and 1.0.59.

A note on the CVE records: the Codex entry names the OpenCode package in its description, and the OpenCode entry contradicts itself on the fixed version. Neither is a reliable source. The GitHub advisories are.

The Actual Lesson

This class of vulnerability is not prompt injection. There is no model to manipulate, no probabilistic behaviour to exploit, no benefit to using a more capable model. The model is simply absent from the attack path.

All three vendors converged on the same structural fix: authorise at execution time, against a specific model event, not against the shape of the incoming data. Google validates tool names and arguments against what the session recorded. Vercel binds relay requests to one-time tokens tied to observed model events. AWS rejects tool-use blocks before the event loop touches them.

The practical takeaways are straightforward. Patch: Google ADK to 2.5.0 or later, `@ai-sdk/harness-codex` to 1.0.29 or later, `@ai-sdk/harness-opencode` to 1.0.28 or later. Treat anything crossing an external boundary as untrusted, including conversation history, confirmation responses, and structured tool calls. Bind authorisation to model events, not data shapes. And give each agent only the tools it actually needs.

If you're running Strands directly rather than through AgentCore's managed API, there is currently no upstream patch. Read the Trusted Message History documentation, then decide whether you trust every caller who can influence your agent's conversation history.