Agent Tool Flaws Across AWS, Google, and Vercel Let Attacks Bypass Model Checks

Security researchers have uncovered a pattern of flaws in agent infrastructure from AWS, Google, and Vercel that allows attackers to trigger tools without the AI model ever running. The issues, presented at Black Hat USA 2026 by Stealth co-founders Hedi Ingber and Aviyam Ivgi, affect Amazon Bedrock AgentCore, Google's Agent Development Kit (ADK) for Python, and Vercel's AI SDK harness packages for Codex and OpenCode.

In normal agent flows, the SDK sends user requests and history to the model, which then decides whether to call a tool. The vulnerable paths skipped this step, accepting data shaped like a model-generated tool call as authoritative. This means system prompts, content filters, and model-level guardrails never had a chance to intervene. The attack conditions differ per product: AWS required an authenticated remote request, Google needed attacker-controlled session events or user-authored function calls, and Vercel required untrusted code already running inside a Linux sandbox.

AWS assigned CVE-2026-18830 (CVSS 8.6) to insufficient input validation in Bedrock AgentCore's InvokeHarness API. An authenticated remote user could place a tool-use block in the final message, causing the event loop to dispatch the tool directly. AWS fixed the managed service before July 31, 2026, adding server-side validation. However, the open-source Strands Python code that AgentCore is built on still contains the model-skipping path. AWS says this falls under customer responsibility and responded with documentation changes rather than a code fix.

Google's first issue, CVE-2026-18236 (CVSS 9.3), affected ADK for Python before 2.5.0. Attackers could forge confirmation approvals for sensitive tools by manipulating session history. A second fix in the same release addressed resumable-mode flows that accepted user-authored function calls, allowing direct execution of registered tools. Google now rejects function calls in user-authored messages. The CVE only covers the continuation-forgery path, not the resumable-mode bypass.

Vercel's flaws affected @ai-sdk/harness-codex through 1.0.28 (CVE-2026-64650) and @ai-sdk/harness-opencode through 1.0.27 (CVE-2026-64651), both with CVSS scores of 6.3. The harness relay trusted any process whose command line contained the path of an approved helper script. Malicious code in the sandbox could invoke host-exposed tools like secret lookups and cloud API calls. Vercel removed the process-path fallback, requiring exact one-time authorizations tied to observed model events. Both fixed versions were published July 10, 2026.

The researchers have not released proof-of-concept code publicly. The advisories do not indicate whether any path was exploited against live deployments. The core issue is that these systems treated tool-call-shaped data as sufficient authority, without verifying it came from a legitimate model turn. The fixes all converge on the same principle: authorize at execution time, binding each tool invocation to the exact model event, tool name, arguments, and session state that produced it. This is not prompt injection - there is no model to fool because the model never gets a turn.

Source: The Hackers News