Hook
Three CVEs, three major platforms, one root cause: the scheduling layer never verified where the data came from. CVE-2026-18830 (AWS Bedrock, CVSS 8.6), CVE-2026-18236 (Google ADK, CVSS 9.3), and CVE-2026-64650/64651 (Vercel SDK, CVSS 6.3) all share a fatal assumption—the system trusts that any data shaped like a tool call must have been generated by the model. GuardFall, a separate study, found 10 out of 11 AI coding agents vulnerable to shell injection. The result is a class of vulnerability that bypasses every model-level guardrail—system prompts, refusal training, alignment—because the attack never touches the model. It hits the plumbing. And in DeFi, where AI agents already automate yield strategies, arbitrage, and liquidation management, that plumbing is the new attack surface.
Context
AI agents are not a speculative concept in crypto. They are deployed today—by hedge funds using LangChain-based trading bots, by DeFi protocols automating liquidity rebalancing, and by individuals running AutoGPT-style scripts to execute swaps. These agents rely on a common architecture: a model (LLM) generates structured tool calls, which are passed to an execution layer that invokes actual functions—like sending a transaction, changing a parameter, or approving a contract. The execution layer, called the "harness" or "scheduler," typically checks only the format of the tool call (e.g., function name and arguments) and executes it. The critical missing check is whether the tool call actually originated from the model in the current session. That gap is the CoreBreak attack vector.
Core
Let me dissect each vulnerability because the pattern is more important than the specific CVE.
AWS Bedrock AgentCore (CVE-2026-18830): An authenticated remote caller can inject a tool use content block into the final message of an InvokeHarness API request. The scheduler sees a valid tool call shape and executes it. The model never generated that call. The system prompt, refusal training, all irrelevant. CVSS 8.6 is generous because the attacker needs to be "authenticated"—but in many Agent architectures, the front-end exposes this API to ordinary users. A standard business account could escalate to arbitrary tool execution. Based on my experience auditing 0x protocol v2 in 2018, I know that reentrancy vulnerabilities often exploited similar trust assumptions about caller identity. The fix is not patching the model; it's binding each tool call cryptographically to the model inference round.
Google ADK for Python (CVE-2026-18236): This is the most dangerous. The attacker can inject or manipulate events in the session history, specifically to forge a human approval for a sensitive tool. Many enterprise agents implement a "human-in-the-loop" step for critical actions—like transferring funds or modifying a smart contract. CoreBreak shows that this approval can be fabricated by injecting a forged event into the session history. The confirmation handler does not verify the tool's ownership or parameter match. CVSS 9.3 is deserved. I have seen similar patterns in DeFi multisig setups where the UI layer trusts the presented transaction data without verifying it against the on-chain execution. The same principle applies here: if the scheduler trusts the session history without cryptographic proof, the approval is a facade.
Vercel @ai-sdk/harness-codex/opencode (CVE-2026-64650/64651): This one is more subtle. The scheduler checks the process path against a list of approved helper scripts. But it trusts the path string provided in the command line. A malicious process inside a Linux sandbox can satisfy the check by presenting a crafted path. The fix is straightforward: verify the actual process identity, not the string. But the underlying issue is again trust in shape over source.
What unifies these three is the "inspection-execution gap." The scheduler inspects the data format but not the data's provenance. The model's safety mechanisms are designed to prevent the model from generating harmful tool calls. But here, the attacker does not need to break the model—they just need to inject crafted data into the pipeline after the model has produced its output. This is equivalent to a man-in-the-middle attack on the agent's execution path. The industry has spent billions on model alignment, but the real vulnerability is in the plumbing.
Contrarian
The prevailing narrative in AI safety circles is that model-level defenses—system prompts, RLHF, constitutional AI—are the primary line of defense. Retail sentiment buys into this: "The model is trained to refuse harmful requests, so my agent is safe." Smart money knows that the weakest link is the execution layer. CoreBreak proves that even a perfectly aligned model can be made to execute arbitrary tools if the scheduler is compromised. The attack is silent: it does not appear in model I/O logs because the injection happens at the scheduler level. Traditional security monitoring sees nothing wrong.
Another blind spot is the human-in-the-loop narrative. Many DeFi protocols that use AI agents for automated decisions still require human approval for high-value actions. CoreBreak shows that this approval can be forged by injecting a single event into the session history. The "human confirmation" becomes a rubber stamp. This is not a theoretical risk—Google ADK, a widely used framework, had this vulnerability. The fix was released in version 2.5.0 on July 16, 2026. But how many production agents are still running older versions?
Finally, the market's reaction will be asymmetric. Managed platforms like AWS Bedrock automatically patched the vulnerability by July 31. Their customers are protected without any manual action. This strengthens the value proposition of "security as a managed service." Self-hosted or open-source frameworks (Google ADK, Vercel SDK) require manual upgrades. Many operators will delay, leaving their agents exposed. This is a competitive advantage for AWS, but it also means that the decentralized, permissionless nature of crypto—where users run their own infrastructure—becomes a liability. The very ethos of "code is law" is undermined when the code is vulnerable and the operator does not upgrade.
Data speaks louder than sentiment. The GuardFall study showing 10 out of 11 coding agents are vulnerable is not an outlier. It is a systematic consequence of the same architectural flaw. The deeper implication is that the entire AI agent supply chain—from the model to the scheduler to the tool execution—needs end-to-end provenance verification. Until that is standard, every agent that executes tools is a potential attack vector.
Takeaway
Within six months, expect a new security category: Agent Runtime Protection. Protocols that use AI agents must either move to fully managed platforms with automatic security updates, or invest in runtime verification—cryptographic binding of each tool execution to the model inference round. The cost of not doing so is a silent compromise of your automation stack. Panic sells, logic buys. The logic here is clear: the plumbing layer is the new battlefield, and the industry is not ready. The question is not whether your agent will be exploited, but whether you will know before the funds are gone.
