Hook: A Metric Anomaly That Demands Forensic Attention
Three CVEs, two critical ratings above 9.0, and one disturbing pattern: the dispatch layer of major AI Agent platforms trusts any properly formatted tool call as valid. This isn't a single developer error. It's a systemic trust boundary flaw embedded in the architecture of AWS Bedrock AgentCore, Google ADK, and Vercel AI SDK. When code speaks, we listen for the discrepancies — and here the discrepancy is that the model's output is bypassed entirely, not manipulated.
Context: The Infrastructure Layer Under the Microscope
The CoreBreak vulnerability suite, disclosed at Black Hat USA 2026 by the Stealth research team, targets the gap between checking and executing in AI Agent orchestration. In standard Agent pipelines, the model generates a tool call in a specific format, the dispatch layer parses it, and the tool executes. The implicit assumption: only the model can produce that format. But in distributed architectures, that assumption fails. Attackers can inject properly formatted tool calls directly into the dispatch layer, bypassing the model's safety mechanisms — prompt injections, refusal training, human approval gates. This is not a model-level attack; it's infrastructure-level bypass. The CVE details are clear: CVE-2026-18830 (AWS, CVSS 8.6), CVE-2026-18236 (Google ADK, CVSS 9.3), and two for Vercel (6.3 each). The cross-platform recurrence proves this is a paradigm flaw, not a bug.
Core: The On-Chain Evidence Chain — Or Lack Thereof
As a data detective, I trace the evidence chain. The core insight emerges from comparing the three platforms' vulnerability profiles. Google ADK's critical 9.3 stems from a forged human approval confirmation — the approval processor does not verify that the tool call originates from a model turn. AWS's 8.6 requires authenticated remote access but allows tool injection via content blocks. Vercel's medium-severity issues involve path traversal in sandboxed execution. The pattern: the dispatch layer trusts format over origin. This is a structural squeeze — the same design flaw across different stacks. My own audit experience from 2017 ICO due diligence taught me that when multiple independent systems exhibit identical failure modes, you're looking at a protocol-level weakness, not a vendor-specific one. Here, the protocol is the Agent orchestration pattern itself. The missing primitive is Model Turn Binding — a cryptographic link between a model's output and the tool call that follows. Without it, any intermediary can inject a fake call. The evidence is in the CVE descriptions: all three platforms assume any data in tool-call format is model-generated. That assumption is now invalid.
Contrarian: Correlation Is Not Causation — But This Pattern Is
Some will argue that these are isolated bugs, quickly patched. AWS auto-deployed a fix by July 31, Google ADK released 2.5.0 on July 16, Vercel patched on July 20. The speed suggests competent security teams. But the contrarian angle is that the fix is superficial — it patches individual instances, not the architectural assumption. The dispatch layer still lacks a standard for origin verification. Meanwhile, the GuardFall study from CSA found that 10 out of 11 AI coding agents had shell injection bypass vulnerabilities. Two independent research teams, same conclusion: Agent security is a systemic problem. Correlation is not causation, but when two separate analyses of different attack surfaces converge on the same root cause — trust in format over origin — the signal is clear. The market euphoria around AI Agent adoption masks this technical debt. Whitepapers lie. Chains don't. And here the chain of evidence shows that the infrastructure layer was never designed to resist injection attacks.
Takeaway: The Next-Week Signal
Watch for MCP (Model Context Protocol) to add an origin verification field as a mandatory standard. Watch for a new security tool category: Agent Security Gateways that validate tool calls against model turn signatures. And watch for enterprise procurement RFPs to demand evidence of dispatch-layer security audits. The bull market narrative will try to ignore this — but the data doesn't care about conviction. The next major Agent exploit will not be a prompt injection; it will be a CoreBreak-class attack on an unpatched platform. The question is not if, but when.