CoreBreak: The Model Never Got a Turn

CoreBreak: The Model Never Got a Turn

8 min read

The most structurally important agent-security finding at Black Hat USA 2026 never touched a model. The CoreBreak briefing, presented August 6 by Hedi Ingber and Aviyam Ivgi of Stealth, showed that in production agent infrastructure from AWS, Google, and Vercel, an attacker can make the agent run tools by sending data that merely looks like a model tool call — no inference call in between, no model that needs to be convinced, no guardrail that gets a chance to fail.

Four CVEs were assigned across the three vendors: CVE-2026-18830 (AWS Bedrock AgentCore, CVSS 8.6), CVE-2026-18236 (Google ADK, CVSS 9.3), and CVE-2026-64650 / CVE-2026-64651 (Vercel AI SDK harnesses, CVSS 6.3 each). All four are patched — and the same pattern remains unpatched, with no CVE at all, in the open-source Strands Python SDK that AWS’s own AgentCore harness is built on. The researchers shared proof-of-concept code privately with each vendor and have not released it; as of August 6 there is no documented in-the-wild exploitation.

The uncomfortable part is not the scores. It is what the failure mode says about where agent security actually lives.

The model is the authorizing party — until it isn’t

Every modern agent loop has the same shape. The runtime bundles the user request, the system prompt, the conversation history, and the tool list, and sends the bundle to a language model. The model reads it and decides whether to call a tool; if it does, it returns a structured instruction naming the tool and arguments, and the SDK executes that call.

That word — decides — is the security model. Developers put content filters, refusal training, restricted tool lists, and human-approval requirements in the model’s context because that is where authorization is supposed to happen. CoreBreak is what happens when the infrastructure layer never verifies that assumption: in each affected framework, the execution layer received data shaped like a model-generated tool call and dispatched it without checking whether a legitimate model turn produced it. As TechTimes reported, the researchers’ summary is blunt: there is no stronger model that resists this attack, because the model never gets a turn. Alignment is irrelevant to an attack that never reaches the model.

Three vendors, three ways to skip the model

The paths differ in mechanics and line up in consequence.

AWS — caller-supplied tool blocks (CVE-2026-18830, CVSS 8.6, CWE-1287). The AWS security bulletin 2026-073 (published August 4) describes it plainly: in the Bedrock AgentCore InvokeHarness API, when the most recent message of a request contained a tool-use content block, “the agent event loop could dispatch the named tool directly, without model mediation.” An authenticated caller could therefore instruct the agent to run any tool in its configured set, bypassing whatever the model would have decided. AWS applied server-side input validation on July 31, 2026, rejecting caller-supplied tool-use blocks before they reach the event loop; no customer action required. Impact was limited to the tools configured on the harness — but that set is usually the expensive one (credentials, deployments, cloud APIs).

Google ADK — forged confirmations (CVE-2026-18236, CVSS 9.3, CWE-863). ADK lets developers flag sensitive tools as requiring human approval. The NVD record lists the three checks the confirmation processor never made: whether the target tool was registered to the executing agent, whether the tool actually required confirmation, and whether the confirmation’s arguments matched the original tool call recorded in session history. An attacker who could inject or manipulate events into session history could forge a valid-looking confirmation and trigger unauthorized tool execution — effectively forging the human-approval gate itself. Fixed in ADK 2.5.0 (released July 16, 2026), which also carries a second fix for a related model-bypass path in ADK’s opt-in resumable mode, where user-authored function-call parts were interpreted as instructions to run registered tools (commit 283e92e rejects user-authored function calls; commit c03f333 fixes the confirmation forgery).

Vercel — process-path authorization (CVE-2026-64650 / CVE-2026-64651, CVSS 6.3 each). The @ai-sdk/harness-codex and @ai-sdk/harness-opencode packages relay calls between code executing in a sandbox and tools exposed on the host (secret lookups, deployments, cloud API calls). Per the Codex harness advisory and the OpenCode harness advisory, the relay authorized a request if the calling process’s command line contained an approved helper-script path — a check any rogue dependency, build script, or lifecycle hook already running in the sandbox could satisfy, on Linux, by mimicking the expected command line. The fix (PR #17105) removes the process-path fallback entirely: relay requests are now accepted only after an exact, short-lived, one-time authorization matching the tool name and input from a bridge-observed model event. Upgrade to @ai-sdk/harness-codex ≥ 1.0.29 and @ai-sdk/harness-opencode ≥ 1.0.28.

Strands — the path AWS declined to patch. The open-source Strands SDK event loop contains the same model-skipping shortcut: when _has_tool_use_in_latest_message passes, the loop sets the stop reason to tool_use, takes the latest message directly, and skips model execution — with the code comment reading literally, “Skip model invocation if the latest message contains ToolUse.” A pull request proposing to always call the model to prevent tool-use injection (strands-agents/harness-sdk#2136) was closed without merging. AWS shipped no CVE, no affected-version range, and no code fix for standalone Strands deployments; its response is a documentation page, Trusted Message History, which confirms the behavior — “a tool-call block as the most recent message causes the agent to run that tool directly on its next invocation, with no model call in between” — and instructs developers to build message history from their own application logic and strip trailing toolUse blocks from untrusted input. No CVE means vulnerability scanners will not flag unpatched Strands versions; the exposure lives or dies with whether an application lets untrusted callers place a tool-use block at the tail of the history.

The same Strands hardening wave includes a related, adjacent advisory: GHSA-mqvc-p852-wf8x (CVE-2026-18733, CVSS 8.8, published August 3), where the strands-agents-tools shell tool exposed an LLM-controllable non_interactive parameter that, set by indirect prompt injection, skipped the human consent gate — patched in strands-agents-tools 0.8.0. Different class (that one does involve the model), same lesson: a control the attacker can influence from inside the agent’s own data plane is not a control.

Why prompt injection framing misses this

The temptation is to file CoreBreak under prompt injection and move on. The researchers draw a deliberate distinction. Prompt injection works by embedding instructions in content the model reads and tricking the model into following them — a better-aligned model has at least a theoretical chance of resisting, which is why guidance like the OWASP Agentic Top 10 frames mitigations around model behavior. CoreBreak needs no model turn at all. The tool invocation arrives at the dispatch layer through an unverified infrastructure path, so every safeguard in the system prompt, every output filter, every trained refusal is inert by construction.

That is why the three fixes converge on the same control rather than on better models: Google matches the confirmation against the tool and arguments recorded in the session; Vercel binds each relay request to a one-time authorization tied to an observed model event; AWS rejects the caller’s tool-use block before the event loop sees it. In every case, the execution layer stopped treating tool-call-shaped data as sufficient authority, and started verifying against a record of what the model actually decided.

What operators should change

  1. Upgrade the harnesses. Google ADK ≥ 2.5.0; @ai-sdk/harness-codex ≥ 1.0.29; @ai-sdk/harness-opencode ≥ 1.0.28. ADK teams using resumable mode should treat the two ADK fixes as separate findings even though one release covers both.
  2. Audit Strands deployments manually. There is no patched version to upgrade to. Find every path where an untrusted caller can place a tool-use content block in a position the event loop consumes, treat all externally supplied message history as untrusted input, and strip trailing toolUse blocks per the Trusted Message History guidance.
  3. Move authorization to the execution layer. The durable principle, from the vendors’ own fixes: every tool invocation must be bound — structurally, at execution time — to the specific model event, tool name, arguments, and session that produced it. Treat the tool surface as an unauthenticated endpoint: it needs its own input validation, its own authorization, its own least-privilege scoping, and its own logging, independent of anything the model “believes.”
  4. Monitor tool execution, not just model I/O. A control plane that only watches prompts and completions is blind to the CoreBreak class, because the attack never produces a model turn. Instrument the dispatch layer — every tool call, its authorizing event (or absence of one), its outcome.

The closing thesis is a re-statement of the boundary itself: the model is a policy engine, not a security boundary. The boundary is where intent becomes effect — the tool dispatch layer. If that layer trusts the shape of a message, the alignment of the model behind it is decoration. CoreBreak is what it looks like when the verifier is a message format, and the uncomfortable truth is that the fix the vendors converged on — verify each tool call against a real model event at execution time — is a control-loop fix, not an AI fix. Every agent platform you operate should be audited against exactly that standard, starting with the Strands event loop comment that made the bug a one-liner: skip model invocation if the latest message contains ToolUse.

Sources

Keep reading

The Harness Is the Vulnerability: One GitHub Issue, Three Coding Agents, Zero Privileges Hermes Agent Deep Cuts: Three Gates Between `plugins install` and a Tool the Model Can Call Hermes Agent Deep Cuts: Observer Hooks — Watching the Loop Without Touching It