Tracing the gas leaks before the code compiles. That’s what I did in 2017 when I found the integer overflow in Golem’s batch claim function. The code compiled. The tests passed. But the logic was wrong. The same pattern repeats in July 2026, three CVEs, three platforms, one root cause: the scheduling layer trusts data shape, not data source. The market didn’t crash. The model didn’t hallucinate. The infrastructure just lied.
This is CoreBreak. A coordinated disclosure from Stealth Research, hitting AWS Bedrock AgentCore, Google ADK for Python, and Vercel’s AI SDK. CVSS scores: 8.6, 9.3, 6.3. The real story is not the numbers. The real story is the pattern: the scheduler accepts any input that looks like a tool call, regardless of origin. Model-level guardrails become decoration. Alignment training becomes irrelevant. The only thing that matters is the plumbing.
Let me give you the context. In July 2026, three vulnerabilities were published under the CoreBreak banner. CVE-2026-18830: AWS Bedrock AgentCore’s InvokeHarness API allows an authenticated remote caller to inject tool use content blocks directly into the final message of a request. The scheduler doesn’t verify that the content block came from the model. It just executes. CVE-2026-18236: Google ADK for Python lets an attacker inject events into the session history, including fake human approval confirmations. The confirmation handler doesn’t verify tool ownership or parameter matching. It just trusts. CVE-2026-64650 and CVE-2026-64651: Vercel’s @ai-sdk/harness-codex and @ai-sdk/harness-opencode check process path by trusting any command-line argument that contains an approved helper script path. A malicious process inside a Linux sandbox can satisfy the check. It just executes.
Three different companies. Three different implementation details. One architecture assumption: the scheduler is a shape checker, not a source verifier. This is not a bug in a single framework. This is a systemic flaw in the design of AI agent execution layers. I’ve seen this before. In DeFi, it’s the same pattern: a smart contract checks msg.sender in the top-level function but not in the internal call. The result is a reentrancy attack. Here, the scheduler checks that the tool call has the right fields – name, arguments, type – but not that it originated from the model’s inference turn. The result is a trust bypass.
The model didn’t fail. The infrastructure did.
Now let’s break down the core. I’ll start with AWS. The InvokeHarness API is the entry point for tool execution in Bedrock AgentCore. According to the CVE description, an authenticated remote caller can include a toolUse content block in the final message of a request. The scheduler processes that block as if the model generated it. There is no check to bind the block to a specific model turn. The system prompt, the refusal training, the alignment – none of that matters because the scheduler never asks the model. It just executes. The CVSS score is 8.6, high severity, but the attack vector is “authenticated remote”. That means the attacker must have valid credentials to call the InvokeHarness API. In a typical enterprise deployment, that API is exposed behind a business API gateway. A normal user session can call it. The attacker doesn’t need admin privileges. They just need a valid session. This turns a low-privilege user into a high-impact agent executioner. The fix was deployed by AWS automatically by July 31, 2026. Customers didn’t need to lift a finger. But the question is: how many deployments were still using the vulnerable version before the window closed? And how many still are, because they didn’t restart the service?
Thing is, the automatic patch is a competitive advantage. AWS can say: “We fix it for you, even if you do nothing.” That’s a strong selling point for enterprise clients who don’t want to manage security. But it also creates a false sense of security. The patch was applied server-side, but the underlying architecture assumption – that the scheduler trusts the shape of the data – remains. The fix is a band-aid. The real cure is a redesign of the trust model.
Now Google ADK. CVE-2026-18236 is the most dangerous of the three. CVSS 9.3, critical. The Google ADK for Python uses a session history to track tool calls and human approvals. An attacker can inject events into that history. If a tool requires human confirmation, the attacker can inject a fake confirmation event. The confirmation handler checks the event structure but not the event source. The tool executes as if a human approved it. This is a complete bypass of the “human-in-the-loop” safeguard. The model might have generated a safe tool call, but the attacker can inject a malicious one. Or the model might have generated a malicious tool call, but the human would have rejected it. With this injection, the human never sees it. The system logs will show a confirmation event, but the human never clicked. The audit trail is falsified. The fix was released in version 2.5.0 on July 16, 2026. But the user must manually update. The security bulletin explicitly states: “Self-hosted users are at significant risk.”
The rug wasn’t pulled by a scammer; it was pulled by the architecture.
I’ve audited enough DeFi contracts to know that “manual update” is a death sentence. In the crypto world, unpatched contracts are exploited within hours. In the AI world, the same applies. The number of Google ADK deployments that are still running version 2.4.x or earlier is unknown. But given the developer-friendly nature of the ADK, many quick prototypes and production workflows are likely unpatched. The risk is not theoretical. It’s a ticking clock.
Then Vercel. The CVEs 64650 and 64651 are lower severity, 6.3, but the attack surface is different. The Vercel AI SDK uses a harness mechanism to execute code in a sandbox. The process path check is supposed to ensure that only approved helper scripts run. The check looks at the command line and sees if it contains the path to an approved script. The attacker can create a malicious process that includes that path in its argument list. The check passes. The malicious code executes. The sandbox is not a sandbox. The fix was released in versions 1.0.29 and 1.0.28. Again, manual update.
The common thread: the scheduler is a pass-through, not a gatekeeper. It checks the format of the data – the shape – but not the provenance. This is the “inspection-execution gap”. The scheduler inspects the data for structure, but executes it without verifying it came from the authorized source. In security engineering, this is a classic vulnerability class: TOCTOU (time-of-check time-of-use) or missing origin validation. The difference is that here, the check and the execution are in the same function, but the source is not part of the check. The model is the only trusted source, but the scheduler never asks the model. It just trusts the data.
Liquidity is just patience with a time limit. But trust without verification is a leak.
Now let’s zoom out. The CoreBreak research is not just three CVEs. It’s a pattern recognition. The Stealth team identified that the flaw is systemic. And they are not alone. The GuardFall research from Adversa AI tested 11 AI coding agents for shell injection vulnerabilities. 10 out of 11 were vulnerable. The same issue: the agent’s execution layer trusts that the tool call data came from the model, but an attacker can inject malicious data at the scheduling layer. The two studies together paint a picture: the AI agent industry has a blind spot. The attention is on model alignment, prompt injection, and RLHF. But the real risk is in the infrastructure. The model can be perfectly aligned, perfectly safe. The infrastructure can still be exploited. The attacker doesn’t need to break the model. They just need to break the scheduler.
This has implications for the MCP – Model Context Protocol. If MCP becomes the standard way for agents to communicate with tools, and if MCP does not define a mechanism for source authentication, then the same trust assumption propagates to every framework that implements MCP. The supply chain becomes the attack surface. The CoreBreak research points this out: “Whether using MCP or proprietary harness packages, the flaw occurs when the system assumes that data in the format of a tool call was necessarily generated by the model.” The MCP specification as of July 2026 does not include message source authentication. That is a supply-chain-level security debt.
So what’s the fix? Not better prompts. Not stronger refusal training. The fix must be at the execution layer: cryptographic or logical binding of each tool call to a verified model turn. The scheduler must have a way to prove that the tool call data was generated by the model in a specific inference turn, and that it hasn’t been tampered with. This could be done via signatures, session-specific nonces, or a trusted execution environment. The cost is performance overhead. Every tool call requires a verification step. For high-frequency agent loops, this could add latency. But the cost of not doing it is much higher: complete compromise of the agent’s actions.
I’ve seen this trade-off before. In 2020, when I ran a high-frequency rebalancing bot on Uniswap V2, I had to decide between speed and verification. I chose speed. I paid the price in impermanent loss. But in security, the opposite is true. The cost of verification is small compared to the cost of a breach. The industry needs to learn that.
Now the contrarian angle. The market narrative is that AI safety is about model alignment. The headlines talk about “jailbreaks”, “red-teaming”, “RLHF failures”. The funding flows to model-level safety startups. The CoreBreak vulnerabilities show that the most dangerous attacks don’t touch the model. They bypass it entirely. The attacker doesn’t need to craft a clever prompt. They just need to call the API with a crafted tool block. The model’s alignment is irrelevant. The human-in-the-loop is irrelevant. The only thing that matters is whether the scheduler checks the source.
The model didn’t fail. The infrastructure did.
This means the security community is misallocating resources. The most valuable investments are not in model safety but in execution layer verification. I’m not saying model safety is useless. But the marginal gain from another RLHF iteration is diminishing. The marginal gain from fixing the scheduling layer is enormous. The same pattern applies to coding agents. The GuardFall study shows that 10 out of 11 coding agents are vulnerable to shell injection. The fix is not better training data. The fix is a proper execution sandbox that validates the provenance of tool calls.
Consider the commercial implications. AWS auto-patches, Google and Vercel require manual updates. This is a competitive differentiator. But it’s also a trap. The auto-patch reinforces the “cloud is safe” narrative. But the underlying architecture assumption remains. The patch is a band-aid, not a redesign. The next CVE will come from the same root cause. The only way to fix it is to redesign the scheduler to include source verification. That will take time. And in the meantime, the attackers are watching.
What should you do? If you are using AWS Bedrock AgentCore, you are patched. But check if your invocation of InvokeHarness API is exposed to authenticated users. Consider adding an additional layer of authorization. If you are using Google ADK, upgrade to 2.5.0 immediately. If you are using a self-hosted version, you are at risk. Vercel SDK users: upgrade to 1.0.29 or 1.0.28. But more importantly, you need to add monitoring at the scheduling layer. The current security operations center (SOC) tools monitor model I/O logs. They won’t see the attack. The attack happens in the scheduler, not in the model. You need to log every tool call execution, including the source of the call. You need to be able to trace back to the model turn. If you can’t, you are blind.
Silence between the blocks tells the real story. If you are not monitoring the scheduling layer, you are listening to silence.
I’ll give you a concrete example. Suppose you have an agent that executes financial transactions. The agent is protected by a human approval step. The attacker injects a fake approval into the session history. The transaction executes. The human never sees it. The audit trail shows a human approval event. Who is at fault? The technology? The human? The architecture. The fault is in the trust model. The scheduler trusted the event because it looked like a valid event. The fix is to bind the event to a cryptographic proof of human action. That is not trivial, but it is necessary.
This is where the industry is heading. The next 12 months will see a wave of startups focusing on agent runtime security. They will offer tools to verify the provenance of tool calls, to monitor the scheduling layer, to enforce policy. The cloud providers will build these features into their platforms. The open-source frameworks will follow. The CVEs will be forgotten, but the architecture change will persist.
I’ve been in the trading world long enough to know that the market always finds the weakest link. In 2022, the weakest link was algorithmic stablecoins. The LUNA collapse proved that infinite growth assumptions are fragile. In 2024, the weakest link was ETF arbitrage latency. The market rewarded speed. In 2026, the weakest link is AI agent scheduling. The market will reward trust verification. The traders who understand this will allocate capital accordingly. The developers who understand this will build secure systems. The rest will be exploited.
Tracing the gas leaks before the code compiles.
I’ll leave you with a forward-looking thought. The CoreBreak vulnerabilities are not the last. They are the first of a class. The pattern will repeat. The same architecture assumption exists in many other frameworks: LangChain, CrewAI, AutoGen, Microsoft Copilot Studio. The GuardFall study only tested 11 coding agents. The vulnerability is likely widespread. The coordinated disclosure for CoreBreak was well-handled. But the next disclosure might not be. The next one might be an exploit in the wild. The question is not if, but when. The silence between the blocks will tell the real story.
And I’ll be watching.