All posts
Unproven Execution

CoreBreak: Agent Tools Fire Without a Model Turn

Five CVEs let attackers fire agent tools in AWS AgentCore, Google ADK, and Vercel harnesses without a model turn ever running — Black Hat CoreBreak

Securityv0 Intelligence Team OWASP: ASI05 sv0 finding: unproven_execution
corebreak unproven-execution agent-harness aws-agentcore google-adk vercel-ai-sdk

The Incident

CoreBreak, disclosed on August 6, 2026 at Black Hat USA 2026 by Hedi Ingber and Aviyam Ivgi of Stealth, is a cross-vendor vulnerability class in agent harnesses from AWS, Google, and Vercel. In each affected runtime, data shaped like a model-generated tool call is dispatched to the named tool without a bona fide model turn having authorized it. System prompts, output filters, and model-side guardrails never see the request because the model never runs. Five CVEs across three vendors were coordinated ahead of the briefing.

Amazon Bedrock AgentCore’s managed InvokeHarness carries CVE-2026-18830 (CVSS 8.6, CWE-1287). Google Agent Development Kit (ADK) for Python released v2.5.0 on July 16, 2026 with commits c03f333 (continuation forgery in the tool-confirmation processor) and 283e92e (rejection of user-authored function_call parts in resumable mode); the default-mode path is tracked as CVE-2026-18236 (CVSS 9.3). Vercel published @ai-sdk/harness-codex 1.0.29 (CVE-2026-64650, CVSS 6.3) and @ai-sdk/harness-opencode 1.0.28 (CVE-2026-64651) to npm on July 10, 2026.

Two AWS Strands Agents Tools CVEs illustrate the credential-exfiltration payoff of the same authority-provenance failure. CVE-2026-15746 exposes an LLM-controllable elasticsearch_memory tool whose es_url, cloud_id, and api_key fields let a crafted prompt SSRF the operator’s Elasticsearch API key to a threat-actor-controlled server (fixed in strands-agents-tools 0.7.0). CVE-2026-18394 exposes an LLM-controllable proxies parameter in the http_request tool that routes credential-bearing requests through an attacker-chosen proxy, defeating the HTTP_REQUEST_TOKEN_CONFIG hostname allowlist (fixed in strands-agents-tools 0.8.2).

MITRE ATT&CK T1552 (Unsecured Credentials) covers the Strands exfiltration path; the harness-dispatch bypass itself has no clean ATT&CK Enterprise technique and is captured under CWE-1287 (Improper Validation of Specified Type of Input).

The Authority Path That Failed

In each affected system, the identity carrying execution authority at the moment of failure was the agent runtime process itself — the AgentCore harness, the ADK executor, the Vercel harness bridge — running with the operator-configured tool set and the operator-attached machine credentials. The scope the runtime held was every tool the operator had wired up: cloud API calls, secret lookups, outbound HTTP, in Strands arbitrary requests. The scope it was meant to exercise was: only tool calls that a bona fide model turn — subject to the operator’s system prompt, output filters, and (in ADK) explicit user confirmation — had emitted.

The trust anchor that failed was provenance verification between the model output and the tool-dispatch step. Rather than binding each tool call to a specific observed model event, the affected runtimes authorized on shape (“this looks like a tool_use block”), on process command line (“this looks like the allowed helper shim”), or on session position (“this arrived where a tool call would arrive”), and dispatched. Vercel’s fix now replaces its process-path fallback with short-lived one-time authorization matching the tool name and input from a bridge-observed model event — an explicit codification of the missing anchor.

SecurityV0 Perspective

CoreBreak is unproven_execution at the framework layer. The Langflow CSV Agent + Python REPL case fit this class because the framework attached a code-execution tool the operator never signed off on; CoreBreak generalizes the pattern to any harness that treats “input shaped like a model event” as authoritative. By construction, this class is invisible to prompt-injection defenses and model-side filters — the model never runs.

What To Do

  • Pin every affected agent-harness runtime to its post-CoreBreak fixed version. Update Google ADK to ≥2.5.0, @ai-sdk/harness-codex to ≥1.0.29, @ai-sdk/harness-opencode to ≥1.0.28, and AWS strands-agents-tools to ≥0.8.2. Confirm your Bedrock AgentCore workloads use the AWS-managed InvokeHarness (CVE-2026-18830 addressed per the vendor advisory) and not a self-hosted equivalent.
  • Inventory every tool-dispatch path in your agent runtimes and prove each one binds to an observed model event. For any dispatch path that authorizes on process command line, request headers, or “shape of the input” rather than on a one-time token issued at the moment the model emitted the tool call, treat it as a CoreBreak-class defect regardless of vendor. This is the exact class no scanner sees.
  • Audit LLM-controllable tool parameters for credential-sensitive fields. In Strands, the elasticsearch_memory connection parameters (es_url, cloud_id, api_key) and the http_request proxies parameter were LLM-controllable and defeated hostname allowlists. Enumerate every tool your agent can call, list which parameters the LLM can populate, and remove or hard-code any that carry credentials or steer where credentials are sent.
  • Rotate every machine credential exposed to a vulnerable harness’s tool set. For any window in which the harness ran unpatched with cloud API keys, secrets-manager tokens, Elasticsearch API keys, or HTTP_REQUEST_TOKEN_CONFIG-bound tokens attached, assume the credential was reachable through an unauthorized tool call and rotate it. Downstream investigation should look for calls whose arguments the model never actually chose.
  • Add a per-agent runtime metric on unproven tool calls. Emit, for every tool dispatch, whether the call was bound to a verified prior model completion for that agent instance. Alert on any non-zero rate of dispatches that lack that binding. This metric would have surfaced CoreBreak-shaped exploitation the moment it started, independent of vendor patch cadence.

Sources

All posts