What happened
At Black Hat 2026 researchers (Aviyam Ivgi, Hedi Ingber) disclosed CoreBreak, a structural flaw where the enforcement point for tool execution and human approval sat inside data the agent could be induced to author. Fed a message history that already contains a tool call or a forged 'approved' event, the harness executes the tool or confirms the approval without the model ever authorizing it, so guardrails wrapped around the model are bypassed entirely. All three vendors shipped emergency fixes that move enforcement to an out-of-band boundary, and Redpanda's companion benchmark shows equivalent failures for prompt-rule-only and reviewer-model guards.
Why it matters
This is a novel agent-execution attack class with working vendor patches: it defeats the industry's primary defense (prompt/guardrail wrapping the model) and also lets an attacker consume a human approval the human never gave. Combined with credential-carrying browser/code-interpreter tools, an injected instruction can steer tools into reading and exfiltrating the execution role's cloud credentials. It is the concrete argument that agent authorization must be enforced outside the agent.
Attack vector
An attacker who can influence the agent's message history (indirect prompt injection in retrieved/ingested content) supplies a message whose latest entry already contains a tool call, so the harness executes the tool with attacker-chosen arguments while the model and every guardrail (system prompt, content filters, refusal training) never fire. A second variant forges an 'approved' confirmation event in that same history, so the human-in-the-loop approval step authorizes an action no human saw.
Affected systems
AWS Bedrock AgentCore (+ Strands SDK) fixed via CVE-2026-18830 (CVSS 8.6); Google Agent Development Kit fixed via CVE-2026-18236 (CVSS 9.3); Vercel AI SDK fixed via CVE-2026-64650 and CVE-2026-64651.
Mitigation
Apply AWS/Google/Vercel patches for the listed CVEs and adopt out-of-band policy enforcement (OBPE): reject caller-authored tool calls, authorize tools at execution time against state the attacker cannot author, and bind each tool invocation to the exact model event and authorization state that produced it.