AWS and Vercel Patch Critical Flaws in AI Agent Platforms Allowing Unauthorized Tool Execution
AWS and Vercel have patched several critical vulnerabilities affecting platforms that power AI agents. The flaws allowed malicious actors to execute tools without proper authorization from the underlying model.
The vulnerabilities belong to a broader attack pattern researchers named CoreBreak. The core issue occurred when infrastructure treated a user-supplied tool call as evidence that the action had been generated and approved by the AI agent itself.
AWS Bedrock AgentCore Impact
In AWS, CVE-2026-18830 affected the InvokeHarness API of Amazon Bedrock AgentCore. An authenticated user could append a specially crafted tool invocation to the end of a request and directly trigger any tools available in the environment without the model reviewing or approving the operation.
Vercel Sandbox Escape Issues
Vercel addressed two vulnerabilities recorded as CVE-2026-64650 and CVE-2026-64651. These issues allowed code running inside a Linux sandbox to reach tools present on the host system. Depending on configured permissions, an attacker could read secrets, interact with cloud APIs, or perform deployment-related operations.
The flaws increased the risk posed by malicious code processed by AI coding agents. No confirmed cases of real-world exploitation have been reported publicly.
Security teams should update affected components, limit the set of tools exposed to agents, and treat conversation history, events, and external calls as untrusted input.
Related articles
Employee Fired After Uploading Corporate Documents to DeepSeek: How Data Security Works in AI Services
A Moscow engineering company dismissed a top manager after she uploaded internal documents to the public DeepSeek service, with the court ruling it a breach of trade secrets. The case highlights a sharp rise in corporate data being sent to public AI models, with one study showing a 30-fold increase in 2025 compared to the previous year. Technical director Yaroslav Shmulyov of integrator R77 AI explains the full processing pipeline, from file ingestion and text extraction to embedding generation and potential use in training. Sensitive data can persist in multiple forms including original files, logs, third-party infrastructure, and model parameters even after deletion requests. Major incidents at Samsung and a U.S. cybersecurity agency demonstrate that even well-resourced organizations struggle with uncontrolled AI usage. Companies are increasingly turning to local and hybrid models to regain control over confidential information while regulators and internal policies lag behind adoption.
AI Agents Given Code and API Access Can Now Assist Attackers
An AI assistant that only answers questions can make mistakes, but an AI agent with access to email, code execution, corporate APIs and internal data can make those mistakes inside production infrastructure. The difference is fundamental: once tools, credentials and internal data are connected to the model, it becomes a privileged user that may not distinguish legitimate commands from hidden instructions on a web page. OWASP lists prompt injection, sensitive data disclosure, unsafe output handling and excessive autonomy as key risks for LLM applications. MITRE ATLAS specifically describes techniques involving prompt injection, context poisoning and tool invocation by AI agents. The article examines how agents differ from chatbots, how attackers can control them through untrusted content, and why a system prompt alone cannot protect code, data and APIs. CyberED is running its free NeuroAugust series of events and materials on AI in cybersecurity, including a session on secure AI system development.
Prompt Injection Emerges as Top Risk for LLM Applications in Production
Prompt injection attacks are moving from theoretical demonstrations to real-world exploits targeting AI assistants in enterprise environments. Attackers embed malicious instructions in emails, documents, and code comments that override developer rules when models process untrusted input. Incidents involving Microsoft 365 Copilot, GitHub Copilot, and Cursor have shown data exfiltration and remote code execution risks with severity scores above 9.0. The core issue stems from the lack of strict boundaries between trusted system prompts and untrusted external content fed into large language models. Defenses require layered controls including code-enforced permissions, input filtering, human confirmation for high-risk actions, and explicit marking of external data. Major vendors including OpenAI, Anthropic, and Google acknowledge that no single static defense can fully eliminate the threat. OWASP ranks prompt injection as the leading risk for LLM applications, urging organizations to treat AI agents as systems with untrusted inputs.
Microsoft Copilot Abused to Accelerate Corporate Account Takeovers and Bank Transfer Frauds
Cybercriminals can leverage Microsoft Copilot to speed up the compromise of corporate accounts and execute financial frauds. In a controlled simulation, researchers demonstrated how the AI assistant helped redirect a $247,500 bank transfer after gaining access to an employee's email. The attack begins with the creation of inbox rules that automatically delete suspicious login alerts, followed by rapid analysis of internal communications to identify high-value targets. Copilot was then used to replicate the victim's writing style and craft a convincing phishing email capable of stealing session tokens and bypassing multi-factor authentication. Once the executive account was taken over, the tool quickly located pending payments and generated a fraudulent request to alter the recipient bank details. The scenario highlights risks from legitimate AI features rather than any specific vulnerability in Copilot itself.