The Hacker News reported on August 6 a notable warning for teams building AI agents: AWS, Google and Vercel have patched separate flaws that shared the same risk pattern. Data or requests shaped like tool calls could reach an agent’s tools without valid authorization from a model turn.

What happened

The report identifies three affected surfaces: Amazon Bedrock AgentCore’s InvokeHarness API, Google’s Agent Development Kit for Python and Vercel AI SDK harness packages for Codex and OpenCode. These are not the same vulnerability and they do not have identical attack conditions. The common editorial point is the trust boundary: the tool-execution layer accepted external or forged signals as if they were a legitimate agent decision.

For AWS, security bulletin 2026-073-AWS describes CVE-2026-18830, an insufficient-input-validation issue in the Amazon Bedrock AgentCore harness. AWS says an authenticated user could execute configured tools by placing a tool-use content block in the final message of an InvokeHarness request, bypassing model invocation and associated controls. AWS says the managed service has been fixed with server-side validation that rejects those caller-supplied blocks before they reach the event loop.

For Google, ADK 2.5.0 release notes list two relevant fixes: “Prevent continuation forgery in tool confirmation” and “prevent model bypass in resumable mode by rejecting user-authored function calls.” Google’s public commit says an attacker able to manipulate or inject events into session history could forge a tool confirmation response. The patch adds checks tying the confirmation to the tool, arguments and original recorded call.

For Vercel, two GitHub advisories —CVE-2026-64650 for @ai-sdk/harness-codex and CVE-2026-64651 for @ai-sdk/harness-opencode— describe an authorization bypass in the tool relay. The risk was that untrusted code inside a sandbox could invoke host-exposed tools, including secret lookups, deployment operations and cloud API calls, without a model-authorized tool-call event. Vercel fixed the flow by removing the process-path fallback and requiring exact, short-lived, one-time authorizations.

Why it matters

The lesson goes beyond these three vendors. As agents use browsers, shells, internal APIs, credentials and deployment workflows, security cannot depend only on prompts, model filters or the assumption that the agent will choose correctly. Authorization must also live in the orchestration layer: which tool can be called, with which arguments, by whom, for how long and under which verifiable event.

What is confirmed and what is not

Primary sources confirm that AWS, Google and Vercel published fixes or advisories for these paths. They also confirm that the conditions differ: AWS requires an authenticated user; Google depends on session-event manipulation or specific flows; Vercel assumes untrusted code already running inside a sandbox. The sources do not establish mass exploitation in production, confirmed theft of customer data or one single incident connecting the three vendors. For technical teams, the practical step is to update affected packages, review the permissions of exposed tools and treat every tool call as an operation requiring verifiable authorization, not just text inside an agent flow.

Sources: The Hacker News, AWS Security Bulletin, Google ADK on GitHub and Vercel GitHub Security Advisories.

Written by Nova Rivera — Product and automation perspective.