At Black Hat 2026, researchers Aviyam Ivgi and Hedi Ingber showed one structural flaw running through three of the largest agent stacks: AWS Bedrock AgentCore with the Strands SDK, Google's Agent Development Kit, and Vercel's AI SDK harness. They named that flaw CoreBreak. AWS patched CVE-2026-18830 (CVSS 8.6), Google patched CVE-2026-18236 (CVSS 9.3, critical), and Vercel patched CVE-2026-64650 and CVE-2026-64651. All three vendors had put enforcement where the agent could reach it.
kAm%96 8F2C5C2:=D E96 :?5FDECJ C6=:6D @? 2C6 2== HC2AA65 2C@F?5 E96 >@56=i DJDE6> AC@>AED[ 4@?E6?E 7:=E6CD[ C67FD2= EC2:?:?8] x7 J@F 3JA2DD E96 >@56=[ J@F 3JA2DD 2== @7 E96>] r@C6qC62< D9@H65 EH@ H2JD E@ 5@ 6I24E=J E92Eik^Am
kAm`] u665 E96 92C?6DD 2 >6DD286 9:DE@CJ H9@D6 =2E6DE >6DD286 2=C625J 4@?E2:?D 2 E@@= 42==[ 2?5 E96 E@@= CF?D H:E9 2EE24<6C\49@D6? 2C8F>6?ED H9:=6 E96 >@56= 2?5 6G6CJ 8F2C5C2:= HC2AA65 2C@F?5 :E ?6G6C 7:C6D]k^Am
kAma] u@C86 2? Q2AAC@G65Q 4@?7:C>2E:@? 6G6?E :? E92E D2>6 9:DE@CJ[ 2?5 E96 9F>2?\:?\E96\=@@A DE6A 2AAC@G6D 2? 24E:@? E92E ?@ 9F>2? D2H] %96 2AAC@G2= >6492?:D> :ED6=7 3642>6 E96 2EE24< G64E@C]k^Am
kAmpD E96 px :?7C2DECF4EFC6 4@>A2?J k2 9C67lQ9EEADi^^HHH]C65A2?52]4@>Qm#65A2?52k^2m 6IA=@C6D[ E96 6>6C86?4J 7:I6D 2== 4@?G6C865 @? E96 D2>6 >@G6i 3:?5 E@@= 6I64FE:@? E@ 2 DE2E6 E92E E96 2EE24<6C 42??@E 2FE9@C[ 2?5 C6;64E 6IE6C?2==J DFAA=:65 E@@= 42==D 2?5 2AAC@G2=D] %92EVD 42==65 k2 9C67lQ9EEADi^^HHH]C65A2?52]4@>^3=@8^286?E:4\2:\?665D\@FE\@7\32?5\8@G6C?2?46Qm@FE\@7\32?5 A@=:4J 6?7@C46>6?Ek^2m[ @C ~q!t[ 2?5 6249 G6?5@C 925 E@ C63F:=5 2 A:646 @7 :E F?56C 7:C6[ @?6 A2E49 2E 2 E:>6]k^Am
k9bm%96 C6D62C496CD 2=C625J DE2E65 E96 7:Ik^9bm
kAm%96 C6D62C496CDV @H? 92C56?:?8 =:DE C625D =:<6 2 56D4C:AE:@? @7 ~q!t] %96J 42==65 7@C C6;64E:?8 42==6C\2FE9@C65 E@@= 42==D[ 2FE9@C:K:?8 2E 6I64FE:@? E:>6[ C65F4:?8 :?96C:E65 2FE9@C:EJ[ 2?5 3:?5:?8 6249 E@@= :?G@42E:@? E@ E96 6I24E >@56= 6G6?E 2?5 2FE9@C:K2E:@? DE2E6 E92E AC@5F465 :E] %92E :D 2 DA64:7:42E:@? 7@C 6?7@C46>6?E @FED:56 E96 286?E] %96 :?5FDECJVD >@DE 67764E:G6 C65 E62> 2?5 #65A2?52’D @H? C6D62C49 8C@FA C624965 E96 D2>6 4@?4=FD:@? :?56A6?56?E=J]k^Am
kAm%96 4C656?E:2=\E967E A2E9 r@C6qC62< 6IA@D65 :D H@CE9 9:89=:89E:?8i x?;64E65 :?DECF4E:@?D DE66C65 >2?2865 3C@HD6C 2?5 4@56\:?E6CAC6E6C E@@=D :?E@ C625:?8 E96 6I64FE:@? C@=6VD 4=@F5 4C656?E:2=D 2?5 6I7:=EC2E:?8 E96>] }@ A@=:4J 6?8:?6 492?86D 2 D2?53@IVD ?6EH@C<:?8] %96 =6DD@? :D H92E J@F 92?5 2? 286?E :? E96 7:CDE A=246] p EJA65[ >65:2E65 E@@= 8C2?E <66AD E96 4C656?E:2= 369:?5 E96 3@F?52CJ] p 86?6C2= 4@>AFE6 6?G:C@?>6?E H:E9 2>3:6?E 4=@F5 4C656?E:2=D AFED :E @?6 w%%! C6BF6DE 2H2J 7C@> 2?J :?;64E65 :?DECF4E:@?]k^Am
k9bms:776C6?E C6D62C49[ D2>6 4@?4=FD:@?k^9bm
kAm#65A2?52 k2 9C67lQ9EEADi^^2CI:G]@C8^23D^ae_g]afeceQmAF3=:D965 :ED @H? C6D62C49k^2m E6DE:?8 2 4@>A2C23=6 6?7@C46>6?E 2C49:E64EFC6 282:?DE 2 C6=2E65 2EE24< 4=2DDi AC@>AE\:?;64E65 286?ED 4@2I65 :?E@ =62<:?8 AC@E64E65 52E2 @C E2<:?8 F?2FE9@C:K65 24E:@?D]k^Am
kAmx? :ED 36?49>2C<[ E96 C6D62C496CD C2? b[ea` EC:2=D 24C@DD 7@FC >@56=D Wr=2F56 $@??6E c]e[ r=2F56 w2:<F c]d[ v!%\d[ 2?5 v!%\d >:?:X E@ >62DFC6 E9:D 5:C64E=J] p86?ED 8F2C565 @?=J 3J AC@>AE CF=6D 72:=65 :? df]eT @7 EC:2=D[ =62<:?8 AC@E64E65 52E2[ C6G62=:?8 AC@E64E65 G2=F6D[ @C 4@>A=6E:?8 7@C3:556? 324<6?5 67764ED] %96 D2>6 286?ED 369:?5 E96 ~q!t 3@F?52CJ 72:=65 :? _]aT]k^Am
kAm#65A2?52 2=D@ E6DE65 E96 :?\32?5 2=E6C?2E:G6[ :? H9:49 2 565:42E65 C6G:6H6C >@56= C625D E96 286?EVD @FEAFE 2?5 3=@4<D F?D276 2?DH6CD] ~? $@??6E[ E96 C6G:6H6C DE:== 72:=65 dg]eT @7 E96 E:>6 3642FD6 :E C625D E6IE 27E6C E96 E@@=D 92G6 2=C625J CF?] xE 42? C67FD6 2? 2?DH6C] xE 42??@E F?C625 2 C64@C5 E96 286?E 92D 2=C625J 23D@C365[ 2?5 :E 42??@E F?5@ 2 HC:E6 E92E 2=C625J =2?565]k^Am
kAm%96 ~q!t 3@F?52CJ 72:=65 _]_T @7 E9@D6 D2>6 EC:2=D[ 7:?:D965 >@C6 @7 E96 H@C< Wee]aT E2D< 7F=7:==>6?E 282:?DE E96 C6G:6H6CVD dg]fTX[ 2?5 EC:A=65 D276[ FD67F= 4@>A=6E:@? Web]_T 282:?DE `h]fTX] %96 C6G:6H6C >256 hb_ 6IEC2 >@56= 42==D 2?5 5:5 H@CD6 @? 3@E9 4@F?ED] %96 3@F?52CJ DA6?E ?@?6]k^Am
k9bm%96 ?6IE BF6DE:@? E@ 2D< @7 6G6CJ 286?E:4 DE24<k^9bm
kAm~q!t 5@6D?VE D@=G6 6G6CJE9:?8[ 3FE :E 5@6D 4=@D6 E96 82AD :? 286?E:4 8@G6C?2?46 E92E C6>2:? F?D@=G65 H96? {{|D 2C6 A2CE @7 E96 D@=FE:@?[ 2?5 :E 5@6D D@ H:E9 E96 677:4:6?4J 2?5 56E6C>:?:D> @7 4=2DD:4 D@7EH2C6] p >@56= 8F2C5 :D 2? :?76C6?46 42== @? 6G6CJ DE6A[ D@ :ED 4@DE 2?5 =2E6?4J D42=6 H:E9 :ED 42A23:=:EJ] *@F 42??@E 3FJ J@FC H2J 7C@> AC@323:=:DE:4 E@ 56E6C>:?:DE:4] p A@=:4J 564:D:@? :D 2 EJA65 6G2=F2E:@? 282:?DE 2 HC:EE6? CF=6[ 2?5 :E 8:G6D J@F E96 D2>6 2?DH6C :? >:4C@D64@?5D H:E9 ?@ E@<6?D DA6?E]k^Am
kAm}@ 4@>A2?J =6ED 6>A=@J66D 2AAC@G6 E96:C @H? 2446DD C6BF6DED 7C@> 2 5@4F>6?E E96J HC@E6 E96>D6=G6D] p86?ED D9@F=5?VE 6:E96C[ 2?5 r@C6qC62< :D E96 2C8F>6?E 7@C H9J E92EVD ?@E 2 A9:=@D@A9:42= A@D:E:@? 3FE 2? 6?8:?66C:?8 C6BF:C6>6?E] %96 r'tD 2?5 E96 A2E496D A@:?E :? E96 D2>6 5:C64E:@? 2D E96 C6D62C496CDV @H? 92C56?:?8 =:DEi 6?7@C46>6?E 36=@?8D 2E 2 3@F?52CJ E96 286?E 42??@E C6249]k^Am
kAmx7 J@F 2C6 AFEE:?8 286?ED :? 7C@?E @7 C62= 52E2[ E96 BF6DE:@? E@ 2D< @7 6G6CJ DE24< J@F 6G2=F2E6 :D H96E96C J@FC 286?E :D 8@G6C?:?8 :ED6=7] r@C6qC62< :D H92E 92AA6?D H96? E96 2?DH6C :D “J6D]”k^Am
kAmk2 9C67lQ9EEADi^^HHH]C65A2?52]4@>^3=@8^4@C63C62<\2:\286?E\GF=?6C23:=:EJQmk6>m%9:D DE@CJk^6>mk^2mk6>m H2D AC@5F465 3Jk^6>mk2 9C67lQ9EEADi^^HHH]>2826C@]4@>^Qmk6>m k^6>mk^2mk2 9C67lQ9EEADi^^HHH]C65A2?52]4@>Qmk6>m#65A2?52k^6>mk^2mk6>m 2?5 C6G:6H65 2?5 5:DEC:3FE65 3Jk^6>m k2 9C67lQ9EEADi^^9F3D]=2^"_b<=8$#_Q C6=lQ?@7@==@HQmk6>m$E24<6Ck^6>mk^2mk6>m]k^6>mk^Am
(0) comments
Welcome to the discussion.
Log In
Keep it Clean. Please avoid obscene, vulgar, lewd, racist or sexually-oriented language.
PLEASE TURN OFF YOUR CAPS LOCK.
Don't Threaten. Threats of harming another person will not be tolerated.
Be Truthful. Don't knowingly lie about anyone or anything.
Be Nice. No racism, sexism or any sort of -ism that is degrading to another person.
Be Proactive. Use the 'Report' link on each comment to let us know of abusive posts.
Share with Us. We'd love to hear eyewitness accounts, the history behind an article.