Affected Systems
Amazon Bedrock AgentCore InvokeHarness API (fixed July 31, 2026; CVE-2026-18830, CVSS 8.6), open-source Strands Python library (unpatched resume path remains), Google Agent Development Kit (ADK) for Python <2.5.0 (CVE-2026-18236, CVSS 9.3), Vercel AI SDK @ai-sdk/harness-codex <1.0.29 and @ai-sdk/harness-opencode <1.0.28. Affects agent infrastructure that dispatches tool calls based on LLM instructions.
Exploitation Status
Proof-of-concept demonstrated at Black Hat USA 2026 under the name "CoreBreak." Attack conditions vary: AWS required authenticated remote request; Google required attacker-controlled session events or user-authored function calls; Vercel required untrusted code in Linux sandbox. No evidence of active exploitation in the wild reported.
Business Impact
Attackers can invoke agent tools—such as database queries, API calls, or file operations—without triggering system prompts, content filters, or model-level guardrails. Impact is bounded by the permissions and tools already wired to each agent. Agents with no sensitive tools are not exploitable. AWS managed service was auto-patched; customers using open-source Strands or older Google ADK/Vercel SDK versions remain at risk if they accept untrusted input in conversation history or session events.
Urgency
🟠 Within 24 hours
Recommended Actions
- Upgrade Google Agent Development Kit (ADK) for Python to version 2.5.0 or later immediately.
- Upgrade Vercel AI SDK packages: @ai-sdk/harness-codex to 1.0.29+ and @ai-sdk/harness-opencode to 1.0.28+.
- If using open-source Strands Python library, review message-history handling to ensure untrusted callers cannot inject toolUse blocks; consult AWS Strands documentation on Trusted Message History.
- Audit agent configurations to identify tools with sensitive permissions (database writes, API calls, file access) and apply principle of least privilege.
- Monitor agent execution logs for tool invocations that lack corresponding model turns or appear outside normal conversation flow.