Tracing the quiet resilience beneath the market often means looking beyond the headlines. This week, the noise is about three CVEs—CVE-2026-18830, CVE-2026-18236, and CVE-2026-64650/64651—collectively named CoreBreak. They expose a flaw so fundamental that it forces a re-evaluation of how we build autonomous systems. The attack doesn't target the model; it targets the plumbing. And the model, no matter how aligned, is powerless to stop it.
Context: The Shared Assumption That Broke
Three of the most prominent AI agent frameworks—AWS Bedrock AgentCore, Google ADK for Python, and Vercel’s @ai-sdk/harness-codex—were found to share a dangerous architectural assumption: the scheduling layer trusts the shape of a tool call without verifying its origin. An attacker can inject a properly formatted tool-use block directly into the execution pipeline, bypassing the model entirely. The model never saw the malicious instruction, so its safety guardrails, system prompts, and refusal training are irrelevant. This is an inspection-execution gap, a class of vulnerability well-known in software security but now migrating to the agentic frontier.
The research team behind CoreBreak, a stealth security firm, demonstrated that the flaw is not a one-off bug but a pattern. In AWS, an authenticated remote caller can inject tool-use content blocks into the final message of the InvokeHarness API. In Google ADK, session history can be manipulated to forge human approval for sensitive tools. In Vercel, process path checks trust any command line containing an approved helper script path, allowing a malicious process inside a Linux sandbox to pass the check. The CVSS scores range from 6.3 to 9.3, but the systemic risk is higher than any single number.
Core: The Anatomy of a Pipeline Betrayal
I have spent years auditing payment rails and cross-chain bridges, and this pattern is eerily familiar. In blockchain, the fundamental insight is that you cannot trust the data; you must verify the source of every message. Otherwise, an attacker can forge a transaction that looks valid but came from a malicious actor. The same principle applies here. The scheduling layer in these agent frameworks is effectively a message bus that treats any well-formed tool call as executable. The model’s reasoning round is a black box that produces a sequence of tokens; the scheduler then parses those tokens into tool calls. But if the scheduler accepts tool calls from outside the model’s token stream, it breaks the chain of custody.
Consider the AWS case. The InvokeHarness API is designed to let developers test agents by providing sample messages. But the scheduler does not verify that the tool-use content block in the final message actually originated from a model inference round. An authenticated attacker can craft a request that includes a valid-looking tool call, and the scheduler will execute it. The model’s system prompt may say “never transfer funds,” but the attacker never asks the model. They simply inject a transfer_funds tool call with arguments. The scheduler, seeing a correctly formatted block, passes it to the execution environment. The model’s safety is irrelevant.
In Google ADK, the attack is even more insidious. The framework allows user confirmation for sensitive tools by storing a “human approval” flag in the session history. The scheduler trusts that flag. An attacker can inject an event that sets the approval flag to true for a tool call that the human never saw. The system then executes the tool as if it were approved. This directly undermines the “human-in-the-loop” design that many enterprises rely on for critical operations like financial transactions or access control changes.
Vercel’s vulnerability is the most subtle. The @ai-sdk/harness-codex package checks whether a requested tool execution process is among a list of approved helper scripts. The check is based on the process path. If an attacker can run arbitrary code inside the sandbox (e.g., via a shell injection), they can spawn a process with a path that matches the approved list, even if the binary is malicious. The scheduler trusts the path string, not the actual binary. This is a classic TOCTOU (time-of-check to time-of-use) issue, but at the agent level.
Contrarian: The Decoupling Myth
The prevailing narrative in AI safety is that the model is the center of the security universe. Invest in better alignment, more robust system prompts, and adversarial training. CoreBreak proves that this narrative is dangerously incomplete. The model is just one node in a pipeline. The scheduling layer, the execution environment, the session store—these are equally critical. The blind spot is that we assume the pipe is sterile. The pipe is not sterile. The pipe is a legacy system designed for a world where all inputs came from the model. But the pipe is now exposed to external inputs, and it has no authentication.
The “decoupling” of agent security from model security is a false dichotomy. The real decoupling should be between the model’s reasoning and the execution of tool calls. The industry needs to treat the execution layer as a threat surface independent of the model. That means every tool call must carry a cryptographic proof of origin from the specific model inference round that produced it. This is analogous to how blockchain transactions carry signatures from the sender. Without such binding, the agent is just a puppet waiting for a malicious puppet master.
Takeaway: The Bridge That Held
Behind the market noise, there is a slow, quiet shift. The CoreBreak disclosure is a signal that the era of trusting the plumbing is ending. The infrastructure that will survive is the one that builds source verification into the protocol from the ground up. The payment rails that carry value across borders already do this. The agent rails that carry tool calls must do the same. The question is not if this will become a requirement, but which platforms will adapt before the next wave of attacks.
Tracing the quiet resilience beneath the market, I see the same pattern: the systems that endure are those that verify, not just at the endpoints, but at every hop. The model is the endpoint. The scheduler is the hop. And the hop is now the weakest link. The bridge held this time because the disclosures were coordinated. But the architecture is still vulnerable. The next core break may not be disclosed.