Security Flaws in AWS, Google, Vercel Agent Infrastructure Allow Tool Bypass
Security researchers Hedi Ingber and Aviyam Ivgi discovered multiple vulnerabilities in agent infrastructure from Amazon Web Services (AWS), Google, and Vercel that allowed attackers to trigger tools without running a model. The flaws let untrusted or forged instructions reach an agent's tools with no check that a model turn had authorized them.
The affected products include Amazon Bedrock AgentCore's InvokeHarness API, Google's Agent Development Kit (ADK) for Python, and the Vercel AI SDK harness packages for the Codex and OpenCode coding agents. AWS has fixed the managed service, Google addressed the issues in ADK 2.5.0, and Vercel patched @ai-sdk/harness-codex in version 1.0.29 and @ai-sdk/harness-opencode in version 1.0.28.
The researchers found that an attacker did not have to persuade the model to break its rules; the attacker could reach the dispatch or authorization path without a legitimate model turn. This meant system prompts, content filters, and model-level guardrails never got a chance to intervene.