CVE-2026-18236, CVE-2026-18830, CVE-2026-64650 and CVE-2026-64651 — together they describe distinct paths by which attacker-supplied data could be treated as a model-authorized tool call, sometimes when “the model never ran at all,” researchers Hedi Ingber and Aviyam Ivgi told The Hacker News.
CoreBreak: the missing proof behind a tool call
At Black Hat USA 2026 the researchers who call the pattern CoreBreak showed a cross-platform design flaw: agent runtimes accepted data shaped like a model-generated tool invocation and treated that shape as sufficient authority. In a normal flow the SDK sends prompts, history and tool definitions to the model, the model returns a structured instruction naming the tool and arguments, and the SDK executes it. The vulnerable paths skipped the model turn entirely — removing system prompts, content filters and model-level guardrails from the decision path.
AWS: Amazon Bedrock AgentCore fixed the managed service; Strands remains a local risk
AWS assigned CVE-2026-18830 (CVSS v4.0 score 8.6) to insufficient input validation in the Amazon Bedrock AgentCore harness. An authenticated remote caller could place a tool-use content block in the final message of an InvokeHarness request; the event loop could then dispatch the named tool directly without invoking the model. AWS says the managed InvokeHarness API was affected before July 31, 2026 and that it added server-side validation rejecting caller-supplied tool-use blocks; the mitigation was applied automatically and requires no customer action.
That managed-service fix does not change the open-source Strands Python code the harness is built on. The upstream event_loop.py contains a shortcut: when _has_tool_use_in_latest_message returns true, the loop sets the stop reason to tool_use, takes the latest message directly and skips model execution — a branch annotated, “Skip model invocation if the latest message contains ToolUse.” An April pull request that proposed removing the shortcut was closed unmerged on June 19. AWS told the researchers the behavior falls under customer responsibility and documented it in a Strands page titled Trusted Message History rather than issuing a code patch or separate CVE for standalone Strands deployments.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleGoogle ADK for Python: continuation-forgery CVE and a separate resumable-mode bypass
Google released ADK for Python 2.5.0 on July 16, 2026 to address two paths. CVE-2026-18236 (CVSS v4.0 score 9.3) covers a continuation-forgery issue in versions before 2.5.0: an attacker who could manipulate or inject events into an agent’s session history could forge the confirmation that a sensitive tool required and cause it to execute. The confirmation processor did not verify the tool belonged to the executing agent, that it actually required confirmation, or that the name and arguments matched the original recorded call; Google’s patch added those checks.
The same 2.5.0 release also fixed a resumable-mode flow that accepted user-authored events containing function_call parts; these could be interpreted as instructions to run registered tools. Google now rejects function calls in user-authored messages. The public CVE record covers the continuation-forgery path only; the researchers said both findings were theirs and warned the CVE should not be used as an umbrella identifier for the resumable-mode issue.
Vercel: a sandbox-to-host relay trusted the process path and was tightened
Vercel’s vulnerabilities affected @ai-sdk/harness-codex through 1.0.28 (CVE-2026-64650) and @ai-sdk/harness-opencode through 1.0.27 (CVE-2026-64651), each scored CVSS v4.0 6.3. The relay trusted a process when its command line contained the path of an approved helper script (host-tool-mcp.mjs for OpenCode, a Codex shim for the other). Malicious code already executing inside a Linux sandbox could satisfy that check and invoke host-exposed tools — secret lookups, deployments, cloud API calls — without a corresponding model-authorized event. Exploitation required Linux, an active harness session with at least one host-provided tool, and untrusted code already running inside the sandbox.
Vercel removed the process-path fallback and changed the relay to accept only an exact, short-lived, one-time authorization tied to the tool name and input observed in a model event. The Hacker News confirmed the patched releases were published on July 10, 2026; both packages have since moved well past those versions (to 1.0.60 and 1.0.59 as of August 5, 2026). Vercel also merged an earlier hardening (pull request 15947, June 10) that added opt-in HMAC-signed tool approvals and input revalidation; that change’s acknowledgement credits Claude and Anthropic’s security team and, per the researchers, traces to Anthropic’s Mythos disclosure under Project Glasswing.
The public CVE entries for the two Vercel packages contain errors: the Codex entry names the OpenCode package in its description and the OpenCode entry’s structured data lists a fixed version contradicted by its text. The Hacker News mapped package names to CVEs using the GitHub advisories, which state affected and patched versions directly.
What this means for technologists, procurement leaders, and end users
- Technologists and security teams: upgrade Google ADK for Python to 2.5.0 or later and Vercel harness packages to @ai-sdk/harness-codex 1.0.29+ and @ai-sdk/harness-opencode 1.0.28+. Treat conversation history, resumable events, confirmation responses and structured tool-use blocks as untrusted when they cross external boundaries and bind invocation to the exact model event at execution time.
- Affected enterprises and procurement leaders: verify whether managed services were auto-patched (AWS applied a server-side mitigation to the managed InvokeHarness API) and audit any standalone Strands deployments or other open-source harnesses for the shortcut that bypasses model invocation; AWS documented Trusted Message History rather than issuing an upstream patch for Strands.
- End users and operators: exposure is bounded by what each agent is allowed to do — an agent wired to no sensitive tools gives an attacker nothing — but the record does not indicate whether any path was exploited in the wild before fixes were applied. The researchers provided proof-of-concept code to vendors and have not released it publicly.
All three vendors converged on the same technical lesson: do not allow the shape of incoming data to stand in for a model turn. Google added session-and-argument checks, Vercel requires one-time authorizations tied to observed model events, and AWS rejects caller-supplied tool-use blocks before the event loop sees them. Absent that control, any safeguard implemented only in a system prompt or a model response disappears when a caller reaches the dispatch path without a legitimate model turn — a shortcoming the community now faces where code and documentation must decide whether the shortcut stays or goes.
