CoreBreak is a critical architectural vulnerability affecting the dispatch layers of AI agent frameworks within Amazon Bedrock AgentCore, Google Agent Development Kit (ADK), and Vercel AI SDK. The flaw allows attackers to bypass the Large Language Model (LLM) entirely by sending forged tool execution instructions directly to the infrastructure responsible for request routing. Because the attack path circumvents the LLM, all model-level safety guardrails, system prompts, and content filters are rendered ineffective. This enables unauthorized tool invocation and the execution of privileged agent actions without required LLM authorization or mediation.

• Threat Model & Vulnerability Overview

  • Targets the "dispatch layer," the intermediary infrastructure responsible for routing LLM decisions to executable tools.
  • Shifts the attack surface from the prompt (Model layer) to the request routing mechanism (Infrastructure layer).
  • Represents a systemic failure in how agent frameworks validate the origin and authorization of tool-call requests.

• Attack Mechanics & Exploitation Vector

  • Attackers craft forged execution instructions that mimic legitimate model outputs to deceive the dispatch layer.
  • These forged instructions are sent directly to the tool-routing infrastructure, triggering function execution without LLM mediation.
  • The "model-less" invocation path ensures that no safety filters, system-level constraints, or guardrails are applied to the input.

• Systemic & Security Impact

  • Renders all existing LLM-based safety guardrails and content filters obsolete during the exploitation path.
  • Enables unauthorized access to integrated tools, potentially allowing database writes, privileged API calls, or internal system commands.
  • Demonstrates a critical cross-platform vulnerability affecting major cloud providers (AWS, Google) and deployment frameworks (Vercel).

• Countermeasures & Remediation

  • Requires a shift in security verification from LLM output validation to rigorous dispatch layer input validation.
  • Necessitates the implementation of cryptographic signing or strict authentication for all tool-call requests.
  • AWS, Google, and Vercel have issued patches to secure the dispatch layer against forged instructions.

• Conclusion

  • CoreBreak underscores a fundamental security gap in "Agentic AI" where trust is misplaced in the LLM's role as a gatekeeper.
  • CISOs must adopt a zero-trust architecture for tool execution, treating the dispatch layer as a primary security boundary.