AWS Fixed Its Managed Agent Service but Left Strands Python SDK Unpatched

Security researchers Hedi Ingber and Aviyam Ivgi presented findings at Black Hat USA 2026 on August 6 showing that the dominant security assumption behind AI agent deployments — that guardrails placed inside a model will contain what the agent can do — fails when the infrastructure layer never verifies whether a model turn authorized the tool call in the first place. The vulnerability class they named CoreBreak affected production infrastructure from Amazon Web Services, Google, and Vercel, covering three distinct attack paths across five CVEs, all of which have been patched — except for a model-skipping code path in the open-source Strands Python SDK that AWS declined to fix with a code change. The CoreBreak briefing appears on the Black Hat USA 2026 schedule .

In any agent built on a modern SDK, a fixed sequence governs every tool invocation. The runtime bundles the user's request, the agent's system prompt, the full conversation history, and a list of available tools, and sends that bundle to a language model. The model reads everything and decides whether to call a tool. If it does, it returns a structured instruction naming the tool and the arguments. The SDK then executes that call.

The word that matters in that chain is "decides." The model is the authorizing party. Its structured output is the evidence that a tool invocation is legitimate. A security-conscious agent developer places controls — content filters, refusal training, restricted tool lists, human-approval requirements — in the model's context, because that is where authorization decisions are supposed to happen.

CoreBreak showed what occurs when the infrastructure layer does not verify that assumption. In each affected framework, the execution layer received data shaped like a model-generated tool call and dispatched it — without checking whether a legitimate model turn had actually produced it. The path to the tool did not go through the model. The Hacker News reported the presentation on August 6.

Amazon's exposure centered on the InvokeHarness API in Amazon Bedrock AgentCore, the company's managed service for hosting production AI agents. The flaw, assigned as CVE-2026-18830 by AWS , received a CVSS v4.0 score of 8.6 and was classified under improper input validation (CWE-1287).

An authenticated remote caller could include a tool-use content block in the final message of an InvokeHarness request. The event loop would then dispatch the named tool directly, without a model invocation in between. Anyone with API credentials could instruct the agent to run any tool in its configured set, bypassing whatever the model might have decided.

AWS added server-side validation on July 31, 2026 , that rejects caller-supplied tool-use blocks before they reach the event loop. The fix was applied automatically to the managed service; no customer action is required.

Strands SDK: The related path AWS declined to patch. The managed-service fix does not cover a comparable model-skipping code path in the open-source Strands Python SDK, which the researchers identified as the library AgentCore's harness is built on. The current upstream Strands event loop source calls a helper named _has_tool_use_in_latest_message , and when that check passes, the event loop sets the stop reason to tool_use , takes the latest message directly, and skips model execution. A in the code reads plainly: "Skip model invocation if the latest message contains ToolUse."

An April 2026 pull request proposed removing that shortcut after flagging that externally injected tool-use blocks could reach execution without a model call. The pull request was closed without merging on June 19.

AWS has not issued a separate CVE, affected-version range, or code fix for standalone Strands deployments. Because no CVE has been assigned, automated vulnerability scanners will not flag unpatched versions. The company responded instead with a documentation change: a page titled "Trusted Message History,"

The practical consequence: any developer who built an agent on the Strands SDK directly — not through the managed AgentCore service — must self-identify and self-remediate. There is no patched version to upgrade to. The exposure depends on whether an application permits untrusted callers to place a tool-use block in the position the event loop consumes.

Google's Agent Development Kit for Python carried two distinct vulnerabilities, both addressed in ADK version 2.5.0, released on July 16, 2026 .

The more severe flaw, tracked as CVE-2026-18236 on NVD (CVSS v4.0: 9.3), affects ADK's tool-confirmation system. ADK lets developers flag sensitive tools as requiring human approval before they execute — a control designed to keep high-stakes actions from running autonomously. The flaw was that the confirmation processor did not verify three things: whether the target tool belonged to the executing agent, whether the tool actually required confirmation, and whether the tool's name and arguments matched the call recorded in the session. An attacker able to manipulate or inject events into an agent's session history could forge a valid-looking confirmation and trigger an unauthorized tool execution. Google's patch added all three missing checks .

The second fix, shipped in the same ADK 2.5.0 release, addresses a separate path in ADK's resumable-mode flows. In that configuration, user-authored events containing function-call parts could be interpreted as instructions to run registered tools — letting an attacker invoke any tool the agent had registered without going through the model. Google's fix rejects function calls embedded in user-authored messages. No separate CVE was issued for the resumable-mode bypass; Google told the researchers that CVE-2026-18236 covers the continuation-forgery issue because it affects ADK's default configuration, while resumable mode is a newer, opt-in feature. Developers using resumable mode should treat both issues as separate findings and confirm they are running ADK 2.5.0 or later.

Vercel's findings are narrower in scope and describe a local rather than remote attack path. Two packages were affected: @ai-sdk/harness-codex ( Codex harness advisory , CVE-2026-64650) and @ai-sdk/harness-opencode ( OpenCode harness advisory , CVE-2026-64651), both carrying a CVSS v4.0 score of 6.3.

These harness packages relay calls between code executing inside a sandboxed environment — where an AI coding agent does its work — and tools exposed on the host system, such as secret lookups, deployment operations, and cloud API calls. The relay was designed to allow only authorized calls through. The flaw was that the relay granted access to a process if its command line contained the path of an approved helper script. Malicious code already running inside the sandbox — a rogue dependency, a build script, a lifecycle hook — could satisfy that check by mimicking the expected command-line pattern, then invoke host-exposed tools without any model-authorized event.

Exploitation required Linux, an active harness session with at least one host-provided tool, and untrusted code already executing in the sandbox. In the context of AI coding agents that routinely handle secrets and deployment credentials, the potential blast radius of a successful exploit was significant even if the attack path required local conditions.

Vercel removed the process-path fallback entirely . The patched relay accepts a request only when it matches an exact, short-lived, one-time authorization tied to a specific tool name and input observed in a real model event. Both fixed versions were published to npm on July 10, 2026.

Note on the CVE records: both contain errors. The Codex entry names the OpenCode package in its description, and the OpenCode entry's structured data lists a fixed version that its own text contradicts. Map each package to its CVE via the GitHub advisories directly, which state the affected and patched versions without ambiguity.

Ingber and Ivgi draw a deliberate distinction between CoreBreak and prompt injection, the more widely discussed AI agent vulnerability class. Prompt injection attacks work by embedding malicious instructions in content the model reads, causing the model to treat those instructions as commands. A better-aligned or better-instructed model has at least a theoretical chance of resisting a prompt injection attempt, a risk class the OWASP Agentic Top 10 addresses extensively.

CoreBreak attacks do not require the model to be fooled, because they reach the tool-dispatch layer without a model turn occurring. As the researchers stated, there is no stronger model that resists this, because the model never gets a turn .

This matters structurally. Every safeguard an agent developer places in a system prompt, every content filter applied to model outputs, every refusal behavior trained into the model — all of it is inert when an attacker can invoke tools through an unverified infrastructure path. The model's alignment posture is irrelevant to an attack that never reaches the model.

Google's record and both Vercel advisories are classified under CWE-863 (incorrect authorization). AWS classified its finding under improper input validation (CWE-1287). Both framings are accurate. The underlying failure in each case was the same: the execution layer treated tool-call-shaped data as sufficient authority to run the tool.

Ingber and Ivgi shared proof-of-concept code privately with each vendor and have not released it publicly. As of August 6, 2026, no confirmed exploitation of any affected path before patching has been documented.

For teams using the affected frameworks, the patching steps are specific:

Upgrade Google ADK for Python to version 2.5.0 or later. Upgrade @ai-sdk/harness-codex to version 1.0.29 or later, and @ai-sdk/harness-opencode to version 1.0.28 or later.

For teams running the Strands SDK standalone — without AgentCore's managed service — no code patch exists. The required action is an audit: identify every path through which an untrusted caller could place a tool-use content block in the agent's conversation history, and treat all externally supplied message history as untrusted input. The Strands Trusted Message History documentation now describes the behavior and the required defensive construction, but the defensive responsibility lies with the application developer.

The broader principle the researchers extract applies beyond these specific frameworks. Authorization for a tool call must be verified at execution time, bound to the specific model event, tool name, arguments, and session that produced it — not inferred from the shape of the incoming data. The three vendor fixes converge on this same control: Google checks a confirmation against the tool and arguments recorded in the session; Vercel binds each relay request to a one-time authorization tied to an observed model event; AWS rejects the caller's tool-use block before the event loop sees it. The full vendor fix analysis is in The Hacker News reporting .

As AI agents gain access to more sensitive systems, secrets, and real-world actions, the security model for the infrastructure running them must be as rigorous as the security model for any other privileged runtime. CoreBreak is evidence that it is not there yet.

Prompt injection works by embedding malicious instructions in content the model reads, tricking the model into following them. CoreBreak attacks bypass the model entirely — the tool invocation reaches the execution layer without the model ever taking a turn. Because the model is never involved, model alignment, system prompt hardening, and output filtering cannot mitigate the attack. The fix must be in the infrastructure layer, where each tool invocation is bound to a verified model event.

No. AWS issued a server-side fix for the managed InvokeHarness API in Amazon Bedrock AgentCore, but it declined to issue a code fix for the same pattern in the open-source Strands Python SDK. No CVE has been assigned to the Strands standalone path, which means automated vulnerability scanners will not flag unpatched versions. Developers using Strands directly must audit their code manually and follow the guidance in AWS's "Trusted Message History" documentation to ensure no untrusted caller can place a tool-use block in the position the event loop consumes.

Yes, but they are distinct. CVE-2026-18236 (CVSS v4.0: 9.3) covers the continuation-forgery path in ADK's default tool-confirmation system. A separate fix in the same ADK 2.5.0 release addresses a model-bypass path in resumable-mode flows, which does not have its own CVE. Both are resolved in ADK 2.5.0. Teams using resumable mode should treat both issues as separate findings and confirm the upgrade.

All three vendor fixes converge on the same control: each tool invocation must be cryptographically or structurally bound to the specific model event, tool name, arguments, and session that produced it. Treating the shape of incoming data — a message that looks like a model-generated tool call — as sufficient authority is the vulnerability. Authorization must be verified at execution time against a record of what the model actually decided, not inferred from what arrived.