AWS, Google, and Vercel Agent Flaws Let Attackers Trigger Tools Without Running the Model
Security flaws in agent infrastructure from Amazon Web Services (AWS), Google, and Vercel let untrusted or forged instructions reach an agent's tools with no check that a model turn had authorized them.
Intelligence analysis by Llama
Security flaws in agent infrastructure from AWS, Google, and Vercel let attackers trigger tools without running the model. The affected products include Amazon Bedrock AgentCore's InvokeHarness API, Google's Agent Development Kit (ADK) for Python, and the Vercel AI SDK harness packages for the Codex and OpenCode coding agents.
Imagine you're using a tool that helps you write code. But what if someone could trick the tool into doing something bad without you even knowing? That's what happened with some tools from companies like AWS, Google, and Vercel. They had a problem that let someone do something bad without the tool checking if it was okay first. Luckily, the companies fixed the problem, but it's a good reminder to always be careful when using tools that help us do things.
Analysis
Vulnerabilities in Agent Infrastructure
The recent discovery of security flaws in agent infrastructure from Amazon Web Services (AWS), Google, and Vercel has raised concerns about the security of these systems. The vulnerabilities, which affect the Amazon Bedrock AgentCore's InvokeHarness API, Google's Agent Development Kit (ADK) for Python, and the Vercel AI SDK harness packages for the Codex and OpenCode coding agents, allow untrusted or forged instructions to reach an agent's tools with no check that a model turn had authorized them.
AWS's AgentCore Vulnerability
AWS's security bulletin assigns CVE-2026-18830, with a CVSS v4.0 score of 8.6, to insufficient input validation in the Amazon Bedrock AgentCore harness. An authenticated remote user could place a tool-use content block in the final message of an InvokeHarness request. The event loop could then dispatch the named tool directly without asking the model. AWS says the issue affected the managed InvokeHarness API before July 31, 2026. It added server-side validation that rejects caller-supplied tool-use blocks before they reach the event loop. The mitigation was applied automatically and does not require customer action.
Google's ADK Vulnerability
The first Google flaw, tracked as CVE-2026-18236 with a CVSS v4.0 score of 9.3, affects ADK for Python versions before 2.5.0. ADK lets a developer flag a sensitive tool as requiring confirmation, which holds the call until a person approves it. An attacker able to manipulate or inject events into an agent's session history could forge that approval and cause an unauthorized tool to execute. The confirmation processor did not verify that the target tool belonged to the executing agent, that the tool actually required confirmation, or that its name and arguments matched the original call recorded in the session. Google's patch added those checks.
Vercel's AI SDK Vulnerability
The Vercel AI SDK harness packages for the Codex and OpenCode coding agents were also affected by the security flaws. The vulnerabilities, which required untrusted code already running inside a Linux sandbox, allowed attackers to reach the dispatch or authorization path without a legitimate model turn. Vercel patched @ai-sdk/harness-codex in version 1.0.29 and @ai-sdk/harness-opencode in version 1.0.28.
Implications of the Vulnerabilities
The security flaws in agent infrastructure from AWS, Google, and Vercel have significant implications for the security of these systems. The vulnerabilities, which allow untrusted or forged instructions to reach an agent's tools with no check that a model turn had authorized them, could be exploited by attackers to gain unauthorized access to sensitive tools and data. The affected products include Amazon Bedrock AgentCore's InvokeHarness API, Google's Agent Development Kit (ADK) for Python, and the Vercel AI SDK harness packages for the Codex and OpenCode coding agents.
Key points
- Security flaws in agent infrastructure from AWS, Google, and Vercel let untrusted or forged instructions reach an agent's tools with no check that a model turn had authorized them.
- The affected products include Amazon Bedrock AgentCore's InvokeHarness API, Google's Agent Development Kit (ADK) for Python, and the Vercel AI SDK harness packages for the Codex and OpenCode coding agents.
- AWS has fixed the managed service, Google addressed the issues in ADK 2.5.0, and Vercel patched @ai-sdk/harness-codex in version 1.0.29 and @ai-sdk/harness-opencode in version 1.0.28.
The companies involved have already fixed the vulnerabilities, which is a positive step towards improving the security of their systems. Additionally, the discovery of these vulnerabilities highlights the importance of regular security audits and testing to identify and address potential issues before they can be exploited.
The fact that these vulnerabilities were able to exist in the first place is a concern, as it suggests that there may be other similar issues lurking in the systems of these companies. Furthermore, the potential for attackers to exploit these vulnerabilities could have significant consequences, including unauthorized access to sensitive tools and data.
