CVE-2026-18830: CoreBreak: AWS, Google and Vercel Agent Runtimes Ran Tools Without Ever Invoking the Model

Stealth researchers Hedi Ingber and Aviyam Ivgi showed at Black Hat USA 2026 that four agent runtimes accepted anything shaped like a model-generated tool call as authoritative, never verifying the model had actually produced it. Sending a crafted tool-use block executes the configured tool directly, which steps around every guardrail a team implemented at the model layer, including the model's own refusals. Amazon Bedrock AgentCore (CVE-2026-18830, 8.6) was fixed server-side, Google ADK for Python (CVE-2026-18236, 9.3) in 2.5.0, and Vercel's @ai-sdk/harness-codex and @ai-sdk/harness-opencode (CVE-2026-64650 and CVE-2026-64651, both 6.3) in 1.0.29 and 1.0.28. The skip-model-invocation branch in the Strands Python SDK that AgentCore is built on is still in main: AWS declined to patch standalone deployments and shipped documentation instead, with no CVE assigned, despite an April pull request warning of exactly this.

You are affected if you run Amazon Bedrock AgentCore (fixed server-side); Google ADK for Python < 2.5.0; @ai-sdk/harness-codex < 1.0.29; @ai-sdk/harness-opencode < 1.0.28; Strands Python SDK unpatched, no CVE.

Patch the three that have fixes. If you run the Strands Python SDK yourself you are still exposed and there is no advisory to track, so audit event_loop.py for the skip-model-invocation branch directly. More broadly, stop treating conversation history, resumable events, confirmation responses and tool-use blocks as trustworthy once they have crossed an external boundary; bind each tool invocation to the exact model event that produced it, and assume any control enforced only in the prompt can be bypassed outright.

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Amazon Bedrock AgentCore and which version, then enforce a policy on it.