At Black Hat USA 2026, researchers Hedi Ingber and Aviyam Ivgi from a company called Stealth presented a cross-platform vulnerability pattern they named CoreBreak, found independently in agent infrastructure from AWS, Google, and Vercel. The common thread across all three: each platform had a path where an untrusted or forged instruction could reach an agent's tools without any check that a legitimate model turn had actually authorized the action. In several of the attack paths the underlying language model never ran at all, the request went straight to tool execution, which means none of the usual safety layers such as system prompts, content filters, or model-level guardrails ever got a chance to see it, because those all assume the model is in the loop. The specific products affected were Amazon Bedrock AgentCore's InvokeHarness API, Google's Agent Development Kit (ADK) for Python, and the Vercel AI SDK's harness packages for its Codex and OpenCode coding agents. Each vendor has already shipped a fix: AWS patched the managed service directly, Google addressed it in ADK 2.5.0, and Vercel patched @ai-sdk/harness-codex to 1.0.29 and @ai-sdk/harness-opencode to 1.0.28. The attack preconditions differed by platform: AWS's required an authenticated remote request, Google's needed attacker-controlled session events or user-authored function calls, and Vercel's required untrusted code already running inside a sandbox, so this is not a single shared bug but a shared architectural blind spot that three independent teams built into their agent harnesses. For developers building or operating agent systems, the practical lesson is that "the model decides" is often an assumption baked into the trust boundary of agent frameworks rather than something actually enforced at the tool-execution layer, and that assumption is worth auditing directly rather than taking on faith, especially in any harness that accepts external session data or runs agent-generated code.