Consensus is broken.
The market believes model-level safety is the last line of defense for AI agents. System prompts. Refusal training. Alignment fine-tuning. The narrative is that if you can keep the model honest, the agent stays honest.
That narrative is wrong.
On July 16, 2026, Stealth published a set of coordinated vulnerability disclosures — CoreBreak — that bypass agent guardrails not at the inference layer, but at the plumbing layer. AWS Bedrock AgentCore, Google ADK, and Vercel SDK all fell. Three different vendors. Three different architectures. One identical root cause: the scheduling layer trusts data that looks like a tool call, without verifying that the data actually came from a model round.
This is not a bug. It's an architectural assumption. And it's the same assumption that has broken DeFi protocols for years.
Context: The Plumbing Layer's Blind Trust
I've been watching this pattern since 2017, when I spent weeks modeling Ethereum's block gas limit controversy. Back then, the consensus was that bigger blocks equal better throughput. The reality was that computational complexity was the bottleneck. The inspection-execution gap — checking the shape of data without checking its origin — was already present in smart contract bridges. Flash loans, reentrancy, oracle manipulation. All exploited the same gap: the protocol assumed that data arriving at the execution layer was valid because it passed the shape check.
Now the same gap has migrated to AI agents.
CoreBreak covers three CVEs:
- CVE-2026-18830 (AWS Bedrock AgentCore, CVSSv4 8.6): An authenticated remote caller can inject tool-use content blocks directly into the final message of an InvokeHarness API request. The scheduler executes them without verifying they came from a model turn.
- CVE-2026-18236 (Google ADK for Python, CVSSv4 9.3): An attacker can manipulate or inject events into the session history, forging human approval for sensitive tool calls. The confirmation handler doesn't verify tool ownership or parameter matching.
- CVE-2026-64650/64651 (Vercel @ai-sdk/harness-codex/opencode, CVSSv4 6.3): Process path checks trust any process binary that contains an approved helper script path. Malicious code inside a Linux sandbox can satisfy the check.
The Stealth team explicitly stated: whether you use MCP or proprietary harness packages, if the system assumes that data in the format of a tool call must have been generated by the model, the failure will occur.
This is not a coincidence. This is a structural design flaw in the current generation of agent frameworks.
Core: The Inspection-Execution Gap in Agent Infrastructure
Let me draw a direct line to the DeFi world I know intimately.
In 2020, I allocated $25,000 of personal savings into the Uniswap V2 ETH/USDC pool. I wasn't just providing liquidity; I was stress-testing the incentive alignment. I spent hours on Discord debating impermanent loss versus APY, challenging the assumption that passive yielding was risk-free. The conclusion was that the protocol trusted its own invariants — the constant product formula — without verifying that the input prices were actually derived from an external market. That was the inspection-execution gap. The shape of the data was correct. The origin was not.
CoreBreak is the same pattern, shifted to agent execution.
The scheduler looks at a message and sees a tool call. It looks like a tool call. It has the right fields. The scheduler executes it. But the scheduler never asks: "Did the model actually generate this?"
In AWS Bedrock, the InvokeHarness API accepts tool-use content blocks in the final message of a request. An attacker with authenticated access — a regular business user, not an admin — can craft a request that includes a malicious tool call. The scheduler sees the shape, executes it, and the model's safety guardrails are never invoked. The attack happens outside the model's I/O. The model's logs show nothing. Standard security operations cannot detect it.
In Google ADK, the vulnerability is even more severe. The session history is mutable. An attacker can inject an event that looks like a human approval for a sensitive tool — a payment execution, a password reset, a database write. The confirmation handler trusts the event shape. The human never actually approved. The agent executes anyway.
This destroys the "human-in-the-loop" safety narrative that many enterprises have built their agent deployment strategies around. The loop is not a loop. It's a check box.
Vercel's issue is more subtle but equally structural. The SDK trusts the process path string to determine whether a child process is authorized. A sandboxed attacker can create a binary at a path ending in the approved helper script name. The string check passes. The scheduler executes the malicious process.
All three cases share a common root: the scheduler checks data shape, not data origin.
This is exactly what happened in the 2022 Terra/Luna collapse. I reverse-engineered the death spiral against global dollar liquidity indices. The algorithmic stablecoin assumed that the market price of LUNA was the correct anchor. It checked the shape of the price feed — the number from the oracle — but not the origin of the market pressure. When the liquidity contraction hit, the shape was still valid, but the origin was a death spiral. The protocol failed.
Agent frameworks are doing the same thing. They assume that because a message looks like a tool call, it must be a legitimate tool call. They don't verify the origin.
Contrarian: The Decoupling Thesis Is False
The prevailing macro view is that AI agents are a separate asset class — a new layer of intelligence that operates independently of blockchain infrastructure. The argument is that agents will run on centralized clouds, using APIs, and the trust model will be based on corporate reputation and SLAs, not on cryptographic verification.
CoreBreak demonstrates that this decoupling is an illusion.
Agents are not independent of the trust problems that plague crypto. They are inheriting the same structural vulnerabilities. The inspection-execution gap is not a blockchain bug. It's a universal software design flaw that appears whenever a system assumes that the format of a message implies its authenticity. DeFi protocols had to learn this lesson the hard way through billions of dollars in hacks. Agent frameworks are now learning the same lesson.
Scale kills decentralization is a signature I've used for years. But here the lesson is different: scale kills trust. As agent frameworks scale to millions of users, they inevitably optimize for throughput over verification. The scheduler becomes a hot path. Every microsecond of latency matters. So the scheduler skips the origin check. It assumes the shape is enough.
This is why the three vendors were hit simultaneously. AWS, Google, and Vercel all optimized for scale. None of them built a cryptographic binding between the model turn and the tool call. None of them treated the session history as an append-only log. None of them verified the process path cryptographically.
Yields are traps. The yield of agent automation — the speed, the cost savings, the productivity gains — is a trap if the underlying trust model is broken. The same way high DeFi yields were traps for liquidity providers who didn't understand the oracle risk.
Takeaway: Cycle Positioning for the Next Phase
CoreBreak is not a one-off vulnerability. It's a signal that the agent industry is entering a new phase of structural maturity. The first phase was model quality. The second phase is execution integrity.
For the next 12 months, the market will shift from "how intelligent is your agent" to "how trustworthy is your agent's execution chain." This will create new security categories: agent runtime audit, tool call signing, session history verification, path attestation. The companies that build these tools will be the new security vendors of the AI era.
For enterprises deploying agents, the immediate action is clear: do not assume that model-level safety is sufficient. Audit your agent's scheduling layer. Verify that your framework prevents tool calls from sources other than the model. If you are using Google ADK or Vercel SDK, upgrade to the patched versions immediately. If you are using AWS Bedrock, confirm that your account has received the automatic fix.
For the crypto-native observer, the lesson is even deeper. The same structural flaws that broke DeFi are now breaking AI agents. The solution will be the same: cryptographic provenance, append-only logs, verifiable execution. The blockchain industry has spent a decade building these primitives. The agent industry is about to discover that they need them.
Consensus is broken. But the fix is known. The question is how fast the industry will adopt it.