Recent security vulnerabilities in agent infrastructures from Amazon Web Services (AWS), Google, and Vercel have been identified, allowing untrusted or forged instructions to reach an agent’s tools without proper authorization from the model. This bypass means that system prompts, content filters, and model-level guardrails could be circumvented, potentially leading to unauthorized actions.
Details of the Vulnerabilities
The affected products include:
- Amazon Bedrock AgentCore’s InvokeHarness API: An authenticated remote user could insert a tool-use content block in the final message of an InvokeHarness request, leading the event loop to dispatch the named tool directly without model verification.
- Google’s Agent Development Kit (ADK) for Python: Vulnerabilities allowed attacker-controlled session events or user-authored function calls to execute tools without model authorization.
- Vercel AI SDK harness packages for Codex and OpenCode coding agents: Untrusted code running inside a Linux sandbox could exploit flaws to execute tools without model oversight.
These vulnerabilities differ in their attack conditions. For instance, AWS’s issue involved authenticated remote requests, Google’s required specific session events or function calls, and Vercel’s necessitated untrusted code within a sandbox environment. Importantly, the potential impact is limited to the capabilities of each agent; if an agent isn’t connected to sensitive tools, the risk is mitigated.
Responses and Mitigations
All three companies have addressed these vulnerabilities:
- AWS: Assigned CVE-2026-18830 with a CVSS v4.0 score of 8.6 to the insufficient input validation in Amazon Bedrock AgentCore’s harness. The issue, affecting the managed InvokeHarness API before July 31, 2026, has been mitigated with server-side validation that rejects unauthorized tool-use blocks before they reach the event loop. This fix was applied automatically, requiring no customer action.
- Google: Addressed the issues in ADK version 2.5.0.
- Vercel: Patched the vulnerabilities in @ai-sdk/harness-codex version 1.0.29 and @ai-sdk/harness-opencode version 1.0.28.
It’s noteworthy that while AWS has fixed the managed service, a similar model-skipping path remains in the open-source Strands Python code, which underlies AgentCore’s harness. The current event loop in Strands can dispatch tools directly if the latest message contains a tool-use block, bypassing model execution. This issue has been acknowledged but remains unaddressed in the open-source version.
These vulnerabilities underscore the importance of rigorous input validation and the need for continuous monitoring of agent infrastructures. As AI agents become more integrated into various applications, ensuring their security is paramount to prevent unauthorized actions and potential breaches.
