I watched the silence break the noise of the AI agent gold rush. At Black Hat USA 2026, the Stealth research team unveiled CoreBreak—a systemic vulnerability that fractures the trust chain between AI models and the tools they command. The silence was not the absence of sound, but the pause before an industry realized its infrastructure was built on an implicit assumption: that any properly formatted tool call must have originated from a model. That assumption is now broken.
Context: The Three Pillars of a Fragile Architecture
CoreBreak is not a single bug. It is a family of vulnerabilities across three of the most prominent AI agent platforms: AWS Bedrock AgentCore, Google ADK, and Vercel AI SDK. Each platform, with its own architecture, fell into the same trap. The dispatch layer—the component that routes tool calls from model output to execution—trusted the format of the data over its origin. This is not a coding error; it is a design flaw in the paradigm of agent orchestration.
| Platform | CVE | CVSS | Attack Vector | |---|---|---|---| | AWS Bedrock AgentCore | CVE-2026-18830 | 8.6 (High) | Remote injection of tool use content blocks | | Google ADK | CVE-2026-18236 | 9.3 (Critical) | Forged human approval confirmation | | Vercel AI SDK | CVE-2026-18831/CVE-2026-18832 | 6.3 (Medium) | Sandbox escape via path traversal |
These vulnerabilities were disclosed in July 2026, with patches applied within two weeks of each other. The narrative shifted from "model safety" to "infrastructure trust" overnight.
Core: The Dispatch Layer's Blind Faith
The core insight is the architectural trust verification gap. In a typical agent pipeline, the model generates a tool call, which is then passed to the dispatch layer for execution. The dispatch layer assumes that because the data is well-formed, it must be from the model. This assumption ignores the possibility of injection through session history, API endpoints, or compromised middleware.
This is distinct from prompt injection. Prompt injection manipulates the model's output. CoreBreak bypasses the model entirely. The attacker does not need to trick the model; they only need to inject a properly formatted tool call into the dispatch layer's input stream. The model is irrelevant. The defense of alignment—RLHF, system prompts, safety training—becomes decoration.
I have seen this pattern before in smart contract oracles. The oracle assumes that because the data feed is formatted correctly, it must be from the trusted source. That assumption led to billions in DeFi exploits. History doesn't repeat, but the architectural flaws do.
The Technical Mechanism
The dispatch layer operates on a "check then execute" model. But the check is only syntactic: does the data conform to the tool call schema? There is no semantic verification of origin. The model's output is cryptographically unsigned, so the dispatch layer cannot distinguish between a genuine model-generated call and an adversarial one that mimics the format.
For Google ADK, the vulnerability allowed an attacker to forge a human approval confirmation by injecting a malicious tool call into the conversation history. The dispatch layer, upon seeing a "confirmed" tool call, executed it without verifying that the confirmation was actually generated by the intended model turn. This is the digital equivalent of a forged signature on a contract.
For AWS, the attacker could inject tool use content blocks into the agent's API, effectively telling the dispatch layer to execute arbitrary tools—database queries, file readers, API calls—without the model ever seeing them. The model's safety filters are bypassed.
For Vercel, the sandbox escape allowed an attacker to satisfy path checks by crafting a malicious file path that passed the validation regex but led to a different directory in the Linux sandbox. The dispatch layer trusted the regex match without verifying the actual resolved path.
Contrarian: The Real Vulnerability is Not the Code
The contrarian angle is that CoreBreak is not a failure of encryption or authentication. It is a failure of trust modeling. The industry has been obsessed with model-level safety—jailbreak detection, content filtering, alignment training. But the infrastructure layer was left unprotected. The market's response will likely be to patch these specific CVEs and move on. Yet the underlying problem remains: agent infrastructure lacks a fundamental trust primitive.
This primitive is what I call "Model Turn Binding"—a cryptographic link between a specific model inference turn and the tool calls it generates. Without this binding, every agent platform is vulnerable to similar bypasses, regardless of how many patches are applied. The attackers do not need to find new bugs; they just need to exploit the same architectural assumption in different contexts.
Furthermore, the fixes applied by the vendors are not equivalent. AWS's automatic deployment of patches is a testament to the security-as-service model. But Google ADK requires manual updates from self-hosted users. In practice, many enterprises will not apply the patch immediately, leaving a window of exposure. The _real_ vulnerability is the gap between patch release and patch adoption—a gap that the architecture itself cannot close.
Takeaway: The Next Narrative
The next narrative in AI agent security will shift from "which model is the safest" to "which infrastructure has the most robust trust primitives." The competition will no longer be about benchmark scores but about the cryptographic integrity of the tool call chain. The question is not whether your agent can be tricked, but whether your infrastructure can be bypassed. Those who invest in Model Turn Binding and dispatch-layer verification will define the standard for secure agent deployment. The silence of the 2021 market noise has given way to a quieter, more dangerous silence—the one before the next exploit.
Based on my experience auditing agent frameworks, I have seen teams spend months aligning models while leaving the dispatch layer as a black box. CoreBreak proves that the black box is a sieve. The market will eventually demand that every agent platform provide a security white paper detailing how tool calls are bound to model turns. Until then, the trust collapse is not a bug—it is a feature of the current architecture.
