CoreBreak: New AI Vulnerability Bypasses Guardrails

A new vulnerability, called CoreBreak, allows attackers to bypass AI agent guardrails. This structural flaw affects the dispatch layers of major AI platforms. Here's the thing: CoreBreak exploits a weakness where systems execute tools without confirming they came from the AI model itself. This means model-level defenses, like system prompts and refusal training, become irrelevant. Three distinct implementations show this problem. AWS Bedrock AgentCore had a high-rated vulnerability, CVE-2026-18830, allowing tool injection. Google ADK for Python had a critical flaw, CVE-2026-18236, where attackers could forge human approval for sensitive tools. Vercel's @ai-sdk/harness packages also had medium-rated vulnerabilities, CVE-2026-64650 and 64651, related to trusting unverified process paths. What's interesting is that CoreBreak is different from prompt injection. Prompt injection tries to manipulate the model; CoreBreak bypasses the model completely. The system trusts data without verifying its origin. The bottom line is that this vulnerability highlights a critical "inspection-execution gap" in AI infrastructure, posing a significant risk to AI system security.