{
  "entry": {
    "kind": "vuln",
    "slug": "cve-2026-18830",
    "name": "CVE-2026-18830",
    "vendor": "Amazon Bedrock AgentCore",
    "description": "Stealth researchers Hedi Ingber and Aviyam Ivgi showed at Black Hat USA 2026 that four agent runtimes accepted anything shaped like a model-generated tool call as authoritative, never verifying the model had actually produced it. Sending a crafted tool-use block executes the configured tool directly, which steps around every guardrail a team implemented at the model layer, including the model's own refusals. Amazon Bedrock AgentCore (CVE-2026-18830, 8.6) was fixed server-side, Google ADK for Python (CVE-2026-18236, 9.3) in 2.5.0, and Vercel's @ai-sdk/harness-codex and @ai-sdk/harness-opencode (CVE-2026-64650 and CVE-2026-64651, both 6.3) in 1.0.29 and 1.0.28. The skip-model-invocation branch in the Strands Python SDK that AgentCore is built on is still in main: AWS declined to patch standalone deployments and shipped documentation instead, with no CVE assigned, despite an April pull request warning of exactly this.",
    "website": "https://thehackernews.com/2026/08/aws-google-and-vercel-patch-agent-flaws.html",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-08-06",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "CVE-2026-18830",
      "aliases": [
        "ti-081"
      ],
      "title": "CoreBreak: AWS, Google and Vercel Agent Runtimes Ran Tools Without Ever Invoking the Model",
      "summary": "Stealth researchers Hedi Ingber and Aviyam Ivgi showed at Black Hat USA 2026 that four agent runtimes accepted anything shaped like a model-generated tool call as authoritative, never verifying the model had actually produced it. Sending a crafted tool-use block executes the configured tool directly, which steps around every guardrail a team implemented at the model layer, including the model's own refusals. Amazon Bedrock AgentCore (CVE-2026-18830, 8.6) was fixed server-side, Google ADK for Python (CVE-2026-18236, 9.3) in 2.5.0, and Vercel's @ai-sdk/harness-codex and @ai-sdk/harness-opencode (CVE-2026-64650 and CVE-2026-64651, both 6.3) in 1.0.29 and 1.0.28. The skip-model-invocation branch in the Strands Python SDK that AgentCore is built on is still in main: AWS declined to patch standalone deployments and shipped documentation instead, with no CVE assigned, despite an April pull request warning of exactly this.",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Privilege escalation"
      ],
      "componentType": "agent",
      "component": {
        "name": "Amazon Bedrock AgentCore",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "Amazon Bedrock AgentCore (fixed server-side); Google ADK for Python < 2.5.0; @ai-sdk/harness-codex < 1.0.29; @ai-sdk/harness-opencode < 1.0.28; Strands Python SDK unpatched, no CVE",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-08-06",
      "modifiedAt": "2026-08-06",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://thehackernews.com/2026/08/aws-google-and-vercel-patch-agent-flaws.html"
        },
        {
          "type": "cve",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18830"
        }
      ],
      "mitigation": "Patch the three that have fixes. If you run the Strands Python SDK yourself you are still exposed and there is no advisory to track, so audit event_loop.py for the skip-model-invocation branch directly. More broadly, stop treating conversation history, resumable events, confirmation responses and tool-use blocks as trustworthy once they have crossed an external boundary; bind each tool invocation to the exact model event that produced it, and assume any control enforced only in the prompt can be bypassed outright.",
      "detectedByAnomity": true
    }
  }
}