Three CVEs. Three different vendors. One common root cause: the orchestration layer trusts data shape, not data source.
CoreBreak is not a bug. It is a pattern. And it exposes the single most dangerous assumption in the AI agent stack today.
—
Over the past 72 hours, the security research community – led by Stealth and Adversa AI – dropped coordinated disclosures hitting AWS Bedrock AgentCore, Google ADK for Python, and Vercel's @ai-sdk/harness-codex. The attack surface is not the model. It is not the prompt. It is the plumbing layer that routes tool calls from model output to execution. And the plumbing trusts any message that looks like a tool call.
CVE-2026-18830 (AWS, CVSS 8.6): An authenticated remote caller can inject tool-use content blocks directly into the final message of the InvokeHarness API. The harness does not verify whether the block originated from a model round. It executes.
CVE-2026-18236 (Google ADK, CVSS 9.3): An attacker can inject or manipulate events in the session history to forge human approval for sensitive tools. The confirmation handler does not validate tool ownership or parameter matching. The human-in-the-loop is a lie.
CVE-2026-64650/64651 (Vercel, CVSS 6.3): Process path checks trust any process whose command-line contains an approved helper script path. A malicious process inside a Linux sandbox can satisfy the check. The sandbox is not a sandbox.
Three different frameworks. Three different attack vectors. One root cause: the orchestration layer checks the shape of the data, not its provenance.
This is the same pattern I saw in early DeFi protocols that trusted any calldata that matched the ABI signature without verifying the caller. The result was the reentrancy disaster of 2016. The result here is that any agent relying on model-level guardrails – system prompts, refusal training, alignment fine-tuning – is running on a broken foundation.
—
Why model defenses cannot help.
Model-level security operates on the input/output pathway. The model sees a prompt, generates a response, and is trained to reject harmful instructions. But CoreBreak does not touch the model. The attack injects tool-use content blocks directly into the harness API, bypassing the model entirely. The system prompt never sees the malicious instruction. The refusal training never fires. The model's I/O logs show nothing suspicious.
This is not a model vulnerability. It is an infrastructure vulnerability. And infrastructure does not negotiate. It executes or it fails.
Security is a feature, not a marketing slide.
The GuardFall research, published alongside CoreBreak, tested 11 AI coding agents. 10 were vulnerable to shell injection bypass. The same pattern: the execution layer trusts that any tool call arriving at the harness must have been generated by a model. That assumption is false.
—
The Contrarian Angle: Human-in-the-loop is not a safety net.
Every enterprise deploying AI agents for financial transactions, system changes, or permission grants has a standard control: "critical actions require human approval." CoreBreak kills that control. CVE-2026-18236 allows an attacker to forge the approval event by injecting a fabricated confirmation into the session history. The UI will show "Approved by human." The audit log will show "User confirmed." But the confirmation never happened.
This is not a theoretical risk. The attack does not require model-level access. It requires only the ability to send crafted events to the agent's orchestration endpoint. If your agent accepts authenticated requests from business users, any user with valid credentials can escalate to arbitrary tool execution.
Numbers do not lie, but they do hide. The CVSS 9.3 score hides the fact that the human approval mechanism is the last line of defense for regulated industries. If that line is forged, the attack leaves no forensic signature in the model logs. The only way to detect it is to monitor the orchestration layer itself – a capability most security operations centers do not have.
—
The Real Impact: Supply Chain Poisoning at Scale.
AI coding agents are now embedded in CI/CD pipelines. They generate code, review PRs, and even deploy. If an attacker injects a malicious tool call into the agent's harness, the agent can generate code that contains backdoors. The code appears to come from a legitimate toolchain. The model never saw the malicious instruction. The developer sees a normal PR. The backdoor ships to production.
This is the software supply chain attack of the AI era. Traditional SBOMs do not cover agent tool call provenance. Current security tools do not inspect the orchestration layer. The gap is enormous.
—
The Takeaway: Execution-Layer Authentication Is the Next Battlefield.
The fix is not better models. The fix is cryptographic binding of every tool call to a verified model round. Every tool execution must carry a nonce, a signature, or a chain-of-custody token that proves it originated from a specific model inference. This is not a patch. It is a fundamental redesign of the agent trust model.
Over the next 12 months, I expect three things:
- Agent framework vendors will scramble to add source verification. AWS already auto-patched; Google and Vercel require manual upgrade. The difference in security posture between managed and self-hosted will widen.
- A new category of "Agent Runtime Security" will emerge. Companies will build gateways that sit between the model and the harness, validating every tool call against a cryptographic proof of origin. This is the DeFi multi-sig for AI agents.
- Regulation will catch up. The EU AI Act's requirement for human oversight will be reinterpreted as "human oversight that cannot be forged." Auditors will demand verifiable proof of approval, not just a log entry.
Survival precedes profit in the unregulated wild. The agents that survive will be those that stop trusting the shape and start trusting the source. The rest will be exploited.
—
The market is sideways. But the signal is clear: the orchestration layer is bleeding. Those who ignore it will be the first to bleed out.
