CoreBreak: The AI Agent Plumbing Leak That Exposes Every Crypto Trading Bot

Hook: Imagine your trading bot—the one that scans for arbitrage opportunities, executes swaps, and rebalances your yield positions. Now imagine it receives a tool call that looks exactly like a legitimate instruction, but the source code behind it is a fake. No prompt injection, no compromised model—just a pipeline that trusts the shape of data over its origin. That's CoreBreak. Three CVEs, two major cloud providers, one developer toolchain, and a shared architectural blind spot that makes every AI agent in crypto as vulnerable as a multisig wallet with a leaked key. I'm not talking about a theoretical attack. CVE-2026-18830 in AWS Bedrock AgentCore lets an authenticated remote caller inject tool-use content blocks directly into the InvokeHarness API. The scheduler never checks if those blocks came from a model round. It just executes. CVE-2026-18236 in Google ADK for Python allows event injection into conversation history, so an attacker can forge a human approval for a sensitive tool. CVE-2026-64650/64651 in Vercel's @ai-sdk/harness-codex lets a rogue process inside a sandbox pass a path check because the scheduler trusts the command-line string over the actual process identity. Three different platforms, same root cause: the scheduler validates shape, not source. Context: The crypto industry has been rushing to integrate AI agents. Think of them as automated DeFi operators: they monitor mempools, trigger aave liquidations, vote on governance proposals, and execute cross-chain swaps. These agents rely on tool-calling frameworks—the plumbing layer that connects the LLM to external APIs, smart contracts, and wallets. The assumption is that the model generates all tool calls, so the scheduler can just execute whatever looks like a valid tool call. That assumption is now broken. The Merge wasn't a tech upgrade, it was a trust migration. We moved from trusting miners to trusting validators, but now we need to trust the scheduler. CoreBreak proves we can't. Core: Let's break down the technical details. In AWS Bedrock AgentCore, the InvokeHarness API is designed to let the agent execute tools. The CVE description says an authenticated remote caller can inject tool-use content blocks in the final message. But here's the kicker: the model's own system prompt and refusal alignment are bypassed because the attack happens outside the model round. The scheduler never asks 'Did this tool call come from the model?' It just checks if the data format is correct. That's a inspection-execution gap. Based on my audit experience with DeFi agent frameworks during the Uniswap v4 hackathon in Miami, I saw the same pattern: tools that were designed to be flexible but ended up trusting any input that looked like a function call. CoreBreak is the formalization of that pattern. Google ADK's CVE-2026-18236 is even more dangerous because it targets the human-in-the-loop safety net. Many DeFi agents require human approval for high-value transactions—like a multisig confirmation. But the vulnerability allows an attacker to inject a fake approval event into the session history. The tool handler checks if there's an approval event, but it doesn't verify that the event was actually generated by a human. It's like a signature that checks the format of the signature, not the signer. The CVSS score of 9.3 reflects the potential for irreversible financial loss. In a crypto context, an attacker could forge approval for a token transfer, a smart contract upgrade, or a governance vote delegation. Vercel's vulnerabilities are more technical but equally relevant for developers building frontend agents. The process path check trusts any process whose command-line argument contains a path to an approved helper script. A malicious process inside the Linux sandbox can simply include that path in its arguments, and the scheduler approves it. For a crypto trading bot running on a Vercel edge function, an attacker could inject a fake tool call that triggers a withdrawal to a wrong address. The sandbox is supposed to isolate, but the path check is a leaky abstraction. The GuardFall research from Adversa AI backs this up: 10 out of 11 tested AI coding agents are vulnerable to shell injection bypass. This isn't a single bug; it's a structural flaw in how we design agent execution. The common thread is that the scheduler equates 'data that looks like a tool call' with 'data generated by a trusted model.' That's a dangerous assumption when the data can be injected from outside the model loop. Contrarian: Everyone is obsessing over model alignment—prompt injection, jailbreaks, fine-tuning attacks. But CoreBreak shows that the biggest threat is not the model; it's the pipeline. Hackers don't hack, they listen. They listen to the architecture assumptions. They listen for the gap between inspection and execution. The crypto industry is particularly vulnerable because we're building agents that touch money directly. We've been so focused on securing the smart contract that we forgot the middleware that controls the execution flow. Here's the contrarian angle: The fact that AWS, Google, and Vercel all have the same class of vulnerability suggests that the problem is not fixable by patching individual CVEs. It requires a fundamental redesign of the scheduler's trust model. The Merge wasn't a tech upgrade, it was a trust migration. But this time, we need to migrate from trust-in-format to trust-in-source. Every tool call must be cryptographically signed by the model round that generated it. That's not just a security patch; it's a new protocol layer. And for the crypto industry, it means that every agent framework—whether it's LangChain, CrewAI, or a custom-built bot—needs to add a verification step that proves the tool call originated from the LLM's output, not from an attacker's payload. Another blind spot: the industry's reliance on human-in-the-loop as a safety net. Google ADK's CVE proves that human approval can be forged. If you're running a DeFi agent that requires a human to approve a large transaction, and the approval is based on session history, an attacker can simply inject a fake approval event. The human never even sees the prompt. This destroys the entire safety narrative around 'we always have a human check.' The check must be cryptographically bound to the UI, not just the session. Takeaway: The next 12 months will be a fork in agent security. On one side, platforms that mandate source verification for every tool call—perhaps through a new standard like MCP with cryptographic signatures. On the other side, agents that continue to trust shape over source, and they will get hacked. For the crypto space, the stakes are high. Automated trading bots, yield optimizers, and governance agents are already moving millions of dollars. If you're building or using an agent, ask your provider: 'Does your scheduler verify the source of every tool call, or just the format?' The answer will tell you if your bot is safe or just lucky. CoreBreak is not a bug report. It's a wake-up call that the plumbing layer is the new attack surface. The model can be perfectly aligned, but if the pipes leak, the house floods. The Merge wasn't a tech upgrade, it was a trust migration. Now we need to migrate again.