CoreBreak: AI Agent Flaws That Let Attackers Bypass Every Guardrail at AWS, Google, and Vercel

Affected Products, CVEs, and CVSS Scores

The Unpatched Open-Source Flaw: Strands Python SDK

The Strands Python SDK is the open-source framework that underlies Amazon Bedrock AgentCore. AWS patched the model-skipping code path in its managed Bedrock AgentCore service (CVE-2026-18830) but declined to patch the same vulnerability in the open-source Strands Python SDK .

• What it is: A "model-skipping" code path that allows the same CoreBreak attack pattern — invoking agent tools without a legitimate model turn — to succeed in self-hosted, non-managed deployments .
• CVE assigned? No. AWS did not assign a CVE or issue a security bulletin for this SDK code path.
• AWS's rationale: The company considers the SDK a developer tool and expects downstream users to implement their own authorization checks when using it outside of the managed Bedrock service .
• Risk: Any application built directly on the Strands Python SDK (without going through the managed Bedrock AgentCore API) remains vulnerable to tool-invocation bypass unless the developer independently adds model-turn authorization logic.

Patch Timelines and Required User Actions

• AWS (CVE-2026-18830, CVSS 8.6): Patched the managed Bedrock AgentCore service server-side. Users of the managed service required no action. However, users of the open-source Strands Python SDK (which underlies AgentCore) remained exposed unless they implemented their own authorization checks .
• Google (CVE-2026-18236, CVSS 9.3): Patched the open-source Agent Development Kit for Python in version 2.5.0. Users must update their ADK Python package to the latest version .
• Vercel (CVE-2026-64650/64651, CVSS 6.3): Patched the AI SDK harness packages. Users must update their Vercel AI SDK dependencies to the patched versions: @ai-sdk/harness-codex 1.0.29 and @ai-sdk/harness-opencode 1.0.28 .

What This Means for AI Agent Security

CoreBreak is not a single software bug but a design-level trust assumption: all three agent frameworks implicitly trusted that tool-call-shaped data arriving at the execution layer had been authorized by a prior model turn. No framework independently verified that authorization . This pattern means that even if a model's safety training is perfect, an attacker who can inject data into the invocation pipeline — for example, via a compromised upstream service or a crafted API request — can execute tools without ever triggering the model's guardrails.

The Strands SDK gap is particularly notable because it demonstrates that cloud vendors may patch their managed services while leaving the same vulnerability open in the open-source components that developers use for self-hosted deployments. For organizations building custom AI agent infrastructure on top of Strands, the responsibility for authorization logic falls entirely on the development team.