When the Model Never Runs, Your Guardrails Don't Either

The most instructive AI security research of the year involves no jailbreak, no adversarial suffix, no prompt injection. At Black Hat USA this week, researchers Hedi Ingber and Aviyam Ivgi presented "CoreBreak," a briefing showing how to make production agent stacks from AWS, Google, and Vercel execute tools — secret lookups, deployments, cloud API calls — while the language model sat idle. Not confused. Not manipulated. Never invoked.

Four CVEs came out of the work, all quietly patched in July, the worst scoring a 9.3. Together they define a vulnerability class that has nothing to do with what the model says and everything to do with what the plumbing around it believes.

Four CVEs, one defect

In Amazon Bedrock AgentCore (CVE-2026-18830, CVSS 8.6), an authenticated caller could append a tool-use content block to the final message of an InvokeHarness request, and the event loop would dispatch the named tool directly — no model turn required. AWS added server-side validation that rejects caller-supplied tool-use blocks and rolled it out before July 31, so managed-service customers have nothing to patch.

Google's Agent Development Kit for Python had the highest-severity issue (CVE-2026-18236, CVSS 9.3). ADK lets you flag a sensitive tool as requiring human confirmation, holding the call until someone approves. But the confirmation processor never verified that the approved tool belonged to the executing agent, that it actually required confirmation, or that its name and arguments matched the original call recorded in the session. Anyone who could inject events into session history could forge an approval. A second path was blunter still: resumable flows accepted user-authored events containing function_call parts and executed them outright. Both were fixed in ADK 2.5.0 on July 16.

Vercel's flaws (CVE-2026-64650 and CVE-2026-64651, both CVSS 6.3) sat in the AI SDK harness packages that wrap the Codex and OpenCode coding agents. Those harnesses run untrusted work inside a Linux sandbox while a host-side relay executes privileged tools. The relay authenticated its peer by checking whether the calling process's command line contained the path of an approved helper script — a string any process in the sandbox can put on its own command line. One malicious dependency or build script, and sandbox code was calling host tools. Patched July 10 in harness-codex 1.0.29 and harness-opencode 1.0.28.

Three vendors, three architectures, one defect. In each case the layer between model and tools received data shaped like a model-generated tool call and treated the shape as the authority.

In-band signaling, forty years later

Phone phreakers broke the telephone network in the 1970s because control signals — the tones that routed calls — traveled in the same channel as the conversation. Whistle the right frequency and the switch obeyed. Chat-completion-style agent protocols recreate that architecture almost exactly: user input, model output, tool results, and, critically, the model's decisions about which tools to run all get serialized into one message list, and the runtime re-derives its state from that list on every turn. The conversation history is simultaneously the data channel and the control channel. Whoever can write history can write control signals.

That's why this class is more dangerous than another prompt-injection variant, and why your existing defense spend does nothing against it. Guardrails, system prompts, output classifiers, injection filters — all of it executes inside the model turn. These attack paths skip the model turn. As the researchers put it, any safeguard implemented only in a system prompt or model response disappears when a caller can reach the dispatch path without a legitimate model turn.

The web solved this exact problem twenty years ago. CSRF worked because forged requests looked legitimate to the server; the fix was binding each state-changing request to a one-time token proving intent. Now look at the July patches: Vercel replaced its process-path check with exact, one-time authorizations tied to model events. Google now verifies tool identity, name, and arguments against the originally recorded call. That's the synchronizer-token pattern, reinvented for tool dispatch under embargo deadline.

The Strands footnote is the tell

The sharpest detail in the research concerns Strands, AWS's open-source agent framework. Its event loop contains the same shortcut as a deliberate feature: a _has_tool_use_in_latest_message check that, when true, skips model invocation and dispatches the tool. A pull request warning about the risk was opened in April and closed unmerged in June. AWS chose to document the behavior — build message history from application code, never from caller input — rather than change it, citing shared responsibility.

So the identical pattern earned a CVSS 8.6 CVE in the managed service and a docs note in the library. That's where the liability line now sits: if you build on open-source harness code, enforcing the model-to-tool trust boundary is your job. And before feeling smug about any of these vendors, check your own agent loop. "Skip the model if the last message already contains a tool call" reads like a perfectly sensible resume optimization, and plenty of home-grown loops have surely implemented it. It is also, verbatim, the bug.

What to actually do

If you're on ADK Python with confirmation flows or resumable agents, pip install -U "google-adk>=2.5.0" today — below that version, anything with write access to your session events could forge approvals. Bump the Vercel harness packages to 1.0.29/1.0.28 or later. AgentCore's managed API is already fixed upstream.

Then do the audit the patches imply. Enumerate every code path that reaches tool dispatch and confirm each one originates from a model event your process observed directly, not one reconstructed from message history. If you have an approval flow, bind approvals to tool name, arguments, and call ID, and make them single-use. Promote your session store into the security perimeter: on an unpatched stack, write access to session events is tool execution, which means multi-tenant session databases and webhook-ingested events deserve the same scrutiny as your auth service. And scope credentials per tool — the talk was titled around credential exfiltration because a forged dispatch is worth exactly the union of the secrets your tools can reach.

This class will recur. The message-list-as-state design is ubiquitous; every framework that replays history each turn must rebuild authority from data an attacker may have touched, and most haven't been audited for it yet. Expect one-time, model-event-bound tool authorization to become a standard harness feature and a standard security-review checkbox, the way CSRF tokens did. The uncomfortable takeaway from Vegas is that the frontier of agent security just moved down the stack — away from the model everyone's been guarding, into the harness almost nobody was.