Three CVEs. One pattern. The scheduling layer trusts the shape of data, not its source. The bytecode lies; the transaction log does not. But here, the transaction log is the attack vector. CoreBreak is not a bug—it is a design assumption that was always wrong.
Last week, the Stealth research team released a coordinated disclosure covering three vulnerabilities: CVE-2026-18830 (AWS Bedrock AgentCore, CVSS 8.6), CVE-2026-18236 (Google ADK for Python, CVSS 9.3), and CVE-2026-64650/64651 (Vercel @ai-sdk/harness-codex/opencode, CVSS 6.3). The common thread: the scheduling layer—the plumbing that routes model reasoning to tool execution—accepts tool call content blocks without verifying they originated from a model reasoning cycle.
This is not a model-level failure. It is an infrastructure-level failure. And it is structural, not incidental.
Context: The Plumbing Layer
AI agents, at their core, follow a loop: receive a prompt, generate a reasoning trace, and then call tools (APIs, databases, code executors) based on that reasoning. The scheduling layer—often called a harness, executor, or runner—parses the model's output for tool call blocks and executes them. It assumes that any block matching the expected JSON schema must have been generated by the model.
Stealth and Adversa AI (the same team behind the GuardFall study that found 10 of 11 coding agents vulnerable to shell injection) independently identified that this assumption is false. An attacker can inject tool call blocks directly into the scheduling layer, bypassing the model entirely. The model's guardrails, system prompts, and refusal training never see the attack. The scheduling layer executes the injected call because it only checks shape, not source.
The three CVEs cover different attack surfaces: AWS requires an authenticated remote call to the InvokeHarness API; Google allows manipulation of session history to forge human approval; Vercel trusts a process path string without verifying the process's origins. But the root cause is identical: inspection-execution gap.
Core: The Evidence Chain
Let me parse each vulnerability with the same forensic lens I use for on-chain data.
CVE-2026-18830: AWS Bedrock AgentCore. The vulnerable endpoint is InvokeHarness, an API designed to run agent tests. A remote caller with valid credentials can inject tool use content blocks in the final message of the request. The scheduling layer does not verify that the block came from a model reasoning cycle. CVSS 8.6 is high, but the qualifier "authenticated" is often dismissed. In many architectures, the agent's backend is exposed to low-privilege users. A normal user account can call InvokeHarness. The model's guardrails are silent. The execution path is: attacker -> API -> schedule -> tool execution. No model involved.
The bytecode lies; the transaction log does not. But here, the transaction log is the API call. It shows an authenticated request. The security team logs model I/O, not API calls to the harness. The attack leaves no trace in the model's inference logs.
CVE-2026-18236: Google ADK for Python. This is the most severe (CVSS 9.3). The agent's confirmation processor—the component that checks for human approval before executing sensitive tools—does not verify the provenance of the approval event. An attacker can manipulate the session history to inject a fake "human confirmed" event. The tool executes as if the user approved it.
Silence in the logs speaks louder than tweets. The attack does not produce a phishing email or a suspicious prompt. It simply writes a JSON event into the session history. The scheduler sees the event, trusts it, and executes the tool. The model never sees the attack. The human never sees the attack. The tool executes a critical operation—transferring funds, changing permissions, modifying code—without consent.
CVE-2026-64650/64651: Vercel SDK. The vulnerability is in the process path check. The harness trusts any process whose command line contains an approved helper script path. In a Linux sandbox, a malicious process can spawn a child process with a path that includes the approved string. The harness executes it. CVSS 6.3 is medium, but in containerized environments where the sandbox is the only isolation, this is a direct path to host compromise.
I have seen this pattern before. In my 2017 Solidity audits, I found integer overflow vulnerabilities because the EVM trusted data types without checking bounds. The scheduling layer trusts data shapes without checking source. Both are assumptions about data provenance, not shape. The EVM assumes the stack will never overflow because the bytecode is generated by a compiler. The scheduling layer assumes the tool call block is generated by the model because it looks like one. Both assumptions fail when an attacker can inject data directly into the execution pipeline.
Trust the hash, verify the execution path. In smart contracts, we learn to treat every external call as potentially malicious. In agent scheduling, we must treat every tool call block as potentially injected until its source is cryptographically verified.
Contrarian: Correlation ≠ Causation
The fact that three vendors are affected does not mean the problem is uniform. The attack surfaces differ. AWS requires authentication. Google requires session access. Vercel requires local sandbox access. The industry narrative that "all agent frameworks are broken" is a simplification.
But the structural pattern is identical. The scheduling layer is designed for performance, not security. It parses JSON shape but not provenance. This is a feature, not a bug—until it is exploited.
The contrarian angle: the vulnerability is not a failure of AI alignment. It is a failure of infrastructure architecture. The model is as aligned as it ever was. The scheduling layer simply does not trust the model's output. It trusts the person who sent the data. That trust is misplaced.
Volatility is noise; structural flaws are signal. The market will panic at the CVSS scores. But the signal is the design assumption: tool call data is self-authenticating. That assumption is false. The fix is not better models. The fix is execution provenance. Every tool call must be cryptographically bound to a verified model reasoning cycle.
Pressure tests expose what calm markets hide. CoreBreak is a pressure test for the entire agent ecosystem. The calm market assumption that "model output is safe" is now exposed as a structural flaw.
Takeaway: The Next 12 Months
Execution provenance will become the new compliance standard. The bytecode lies; the transaction log does not. But only if you verify the log's source. CoreBreak is the wake-up call.
The question is not whether your model is aligned. The question is whether your scheduling layer can be trusted to execute only what the model intended.
If you are running an agent framework without execution provenance—without a cryptographic binding between model reasoning and tool call—you are running on borrowed time. The scheduling layer is the new attack surface. Trust the hash. Verify the execution path.
Data does not dream; it only records. The data from CoreBreak records a structural flaw that will reshape agent security for the next cycle. The repair is not a patch. It is a redesign of the trust boundary.