CVSS 9.3. Three major platforms. One structural flaw.
Over the past 72 hours, I've been dissecting the CoreBreak advisories. CVE-2026-18830 (AWS Bedrock AgentCore), CVE-2026-18236 (Google ADK), and CVE-2026-64650/64651 (Vercel @ai-sdk). The scores alone tell a story: 8.6, 9.3, 6.3. But the real story is the pattern. The industry's AI agent infrastructure trusts the shape of a tool call, not its source. Every crypto project building trading bots, DeFi automation, or NFT marketplaces on top of these frameworks just inherited a systemic risk. Data over drama.
Context: The Agent Plumbing Layer
Crypto has rushed to integrate AI agents. Automated yield farming, arbitrage execution, social sentiment analysis for NFT flips. The stack is seductive: a large language model (LLM) interprets natural language, decides on actions, and calls external tools (APIs, smart contracts, databases) via a scheduler. The scheduler is the "plumbing layer." It's supposed to only execute commands that the model generated. But CoreBreak reveals that the scheduler doesn't verify the origin of the tool call. It only checks if the data looks like a valid tool call. The model's alignment, system prompts, and refusal training are bypassed entirely. This is not a prompt injection. This is a direct attack on the execution pipeline.
Crypto projects that rely on these frameworks for critical operations—like triggering a swap on Uniswap, signing a multisig transaction, or adjusting a lending position—are exposed. The vulnerability allows an attacker to inject arbitrary tool calls into the final message of a conversation, bypassing the model entirely. In the case of Google ADK, the attacker can even forge the "human approval" event. The human-in-the-loop narrative? Dead.
Core: The Order Flow Analysis of a Broken Pipeline
Let me break down the three vulnerabilities with the same rigor I apply to order book slippage.
AWS Bedrock AgentCore (CVE-2026-18830). The InvokeHarness API accepts a final message from the client. The scheduler checks if the message contains tool-use blocks. If yes, it executes them. The problem: it never validates that those blocks were actually produced by the model during the conversation. An authenticated remote caller can inject any tool call. CVSS 8.6. The attack surface is any agent that exposes this API behind an authenticated endpoint. In crypto, that's every trading bot that uses Bedrock for decision-making.
Google ADK for Python (CVE-2026-18236). This one is worse. The agent's session history is mutable. An attacker can inject a fake "human approval" event into the history. The tool execution handler sees the approval timestamp and executes the tool. No real human ever confirmed it. CVSS 9.3. For crypto projects that require manual approval for high-value transactions (e.g., moving funds from a hot wallet to a cold one), this is a direct bypass. The attacker can drain the wallet by forging the approval chain.
Vercel @ai-sdk (CVE-2026-64650/64651). The process path check trusts any process that matches the path of an approved helper script. But a malicious process in the same Linux sandbox can satisfy the check. CVSS 6.3. For crypto frontends that use Vercel's SDK to run agent-assisted trading interfaces, an attacker who compromises the client-side code can execute arbitrary helper scripts.
Numbers don't lie. The common root cause is what I call the "inspection-execution gap." The scheduler inspects the format of the tool call but does not trace its origin to a specific model round. The fix requires cryptographic binding: every tool call must be signed by the model's execution round. No signature, no execution.
Contrarian: The False Comfort of "Human-in-the-Loop"
The crypto industry loves the "human-in-the-loop" narrative. We tell ourselves that even if the AI makes a mistake, a human will approve the final action. CoreBreak proves that this is a structural illusion. The Google ADK vulnerability allows the attacker to forge the approval event. The human never sees the malicious request. The approval log shows a "confirmed" action that never happened.
This is not a bug in the model. It's a bug in the infrastructure. The same infrastructure that crypto projects have adopted without security audits. I've seen this before. In 2022, when Terra collapsed, the infrastructure failed. The oracle design was flawed. The liquidation engine was slow. Now, the agent infrastructure is the new oracle. We're trusting the plumbing layer to be honest, but it's not.
The counterintuitive takeaway: stronger models, better prompts, more RLHF? Worthless. The attacker never touches the model. They inject directly into the scheduler. The only defense is to redesign the scheduler to verify the source of every tool call. This means adding a cryptographic layer that ties each tool invocation to the model's exact response. It's expensive. It's complex. But it's the only way.
Liquidity vanishes. Lessons remain.
Takeaway: Actionable Levels for Crypto Projects
The bear market is unforgiving. Survival depends on infrastructure discipline. Here's what you need to do:
- Audit your agent pipeline. If you're using AWS Bedrock, Google ADK, or Vercel's AI SDK, you are exposed. Check if your agent exposes the InvokeHarness API or uses mutable session history. If yes, assume it's compromised.
- Implement source-bound tool calls. Do not trust any tool call that does not carry a cryptographic proof of its model origin. This is non-negotiable. If your framework doesn't support it, build a middleware or switch to a custom solution.
- Rethink human approval. The "human approval" step must be cryptographically bound to the specific request. Use a hardware-verified signature that matches the model's output. Anything less is a liability.
- Monitor the scheduler layer, not just the model logs. Traditional security ops look at prompt logs. They won't see the attack. You need to monitor every tool execution and verify its source. This is a new data stream. Build it.
The market will separate the disciplined from the careless. Projects that fix their agent infrastructure now will survive the next cycle. Those that don't will be the next Terra. Calculate. Execute. Repeat.