Three CVEs. One root cause. The scheduling layer trusts data shape, not data source. That is the single sentence summary of the CoreBreak research, a coordinated disclosure that hit AWS Bedrock, Google ADK, and Vercel SDK in July 2026. The industry has been selling "AI agent safety" as a model-level problem—system prompts, refusal training, alignment RLHF. This isn't. This is a plumbing failure. And when the plumbing leaks, the entire house floods.
Let me be clear: I have spent four months auditing a single exchange protocol in 2018, and I found one integer overflow. This research found three separate CVEs across three different platforms, all exploiting the same architectural blind spot. That is not a coincidence. That is a systemic defect.
Context: The Hype and the Blind Spot
AI agents are the new frontier. Autonomous coding assistants, automated trading workflows, contract execution—all run on frameworks that promise "human-in-the-loop" safety. The narrative is seductive: the model is smart, the guardrails are tight, and the human approves the final call. But the reality is that the execution layer—the scheduling engine that routes tool calls from the model to the actual API—was never designed to verify the source of those calls. It checks format. It does not check origin.
This is the CoreBreak insight: model-level defenses are irrelevant when the attacker can inject a tool call directly into the scheduling layer, bypassing the model entirely. The model never sees the malicious prompt. The logs never show the attack. The human approval screen shows a fake confirmation. The system executes.
Core: The Systematic Teardown
Three vulnerabilities, three different platforms, one identical flaw.
CVE-2026-18830 (AWS Bedrock AgentCore, CVSSv4 8.6 – High): An authenticated remote caller can inject tool use content blocks into the final message of an InvokeHarness API request. The scheduler does not verify whether the content block actually originated from a model turn. It just sees a valid format and executes. AWS fixed this automatically by July 31—the benefit of a managed service. But the question remains: why was the InvokeHarness API ever designed to accept tool content from an external request? That is a design choice, not a bug.
CVE-2026-18236 (Google ADK for Python, CVSSv4 9.3 – Critical): This is the most dangerous one. The attacker can manipulate the session history to inject a fake event that simulates a human approval for a sensitive tool. The confirmation handler trusts the event data without verifying the tool ownership or parameter match. Human-in-the-loop becomes a simulation. The signature for this vulnerability: "Forensics don't lie." But the session history does.
CVE-2026-64650/64651 (Vercel @ai-sdk/harness-codex/opencode, CVSSv4 6.3 – Medium): The process path check trusts any process that contains an approved helper script path. A malicious code inside a Linux sandbox can satisfy the path check by simply including the approved string. The scheduler assumes that if the path looks right, the process is safe. Again, shape over source.
The common architecture defect: The scheduling layer was designed to be fast and flexible. It parses tool call content blocks, event structures, and process paths based on format. It never checks cryptographic provenance. It never binds a tool call to a verified model turn. The research team from Stealth labeled this the "inspection-execution gap"—the difference between what the system inspects (format) and what it executes (content). The narrowest gap can be the most expensive.
GuardFall study corroboration: 10 out of 11 AI coding agents tested were vulnerable to shell injection that bypassed model-level controls. This is not a one-off bug. It is a pattern. The execution layer is the new attack surface.
Contrarian: What the Bulls Got Right
To be fair, the defenders are not entirely wrong. Model-level defenses do work for prompt injection that goes through the model. They are necessary. But they are not sufficient. The bulls have been selling a narrative that "alignment" is the solution to agent safety. It is not. Alignment trains the model to refuse certain inputs. It does not train the scheduler to verify the provenance of tool calls. The AI safety industry has been investing in the wrong layer.
Another point: the CVSS scores vary widely. AWS's 8.6 requires authenticated remote access—but in many enterprise deployments, the InvokeHarness API is exposed behind a business API gateway. A low-privilege user account can become a vector for horizontal privilege escalation. Google's 9.3 is critical because it directly undermines the human approval mechanism, which is the last line of defense for many regulated workflows. Vercel's 6.3 is medium because it requires a sandbox escape first—but in combination with other vulnerabilities, it becomes a chain.
The bulls might argue that automatic patching from AWS and Google's managed services mitigates the risk for most customers. They are right for the cloud side. But the open-source users of Google ADK and Vercel SDK must manually upgrade. The article states: "Self-hosted operators are at significant risk." That is a liability cascade.
Takeaway: The Accountability Call
The Agent infrastructure industry must rewrite the trust model of the scheduling layer. Every tool call must be cryptographically bound to a verified model turn. Every human approval event must include a non-replayable proof of origin. The MCP (Model Context Protocol) must define source authentication before it becomes the standard. Otherwise, the next generation of AI agents will be trustless by design—and not in the good way.
Code does not lie; people do. But the code here is the problem. The scheduling layer was built for speed, not for security. It is time to audit the promise, not the poster. The question is not whether the model is smart. The question is whether the execution layer can be trusted.
High yield is a warning, not a welcome. The same applies to agent safety: if the scheduling layer does not verify the source, the guardrails are a mirage. Three CVEs. One root cause. Start fixing.