AI dispatch layer flaws expose critical agent security gap
The gist
A newly discovered security flaw lets rogue AI agents hijack higher-privilege peers and sidestep traditional defenses across Google, AWS, and Vercel platforms.
What to know
- Pillar Security’s CoreBreak exploit exposes a critical dispatch layer weakness in Google’s ADK, allowing low-privilege AI agents to manipulate more powerful ones and perform unauthorized actions.
- This vulnerability spans major platforms like AWS Bedrock, Google ADK, and Vercel AI SDK, bypassing model-level protections by directly invoking tools and exploiting unchecked tool-call data.
- High-severity CVEs (up to 9.3 CVSS) and legacy flaws like insecure deserialization in frameworks such as LangChain and LangGraph highlight a blind spot in agent security that current AI safeguards miss.
Agent-on-Agent Exploits Unveiled
CoreBreak exposes a new frontier in AI risk, where low-privilege agents can stealthily hijack high-privilege counterparts to execute unauthorized and destructive actions.
In a groundbreaking revelation, Pillar Security exposed the first-ever agent-on-agent exploit within Google's AI Development Kit (ADK), termed the CoreBreak vulnerability. This exploit uniquely enables a low-privilege AI agent to covertly manipulate a higher-privilege agent, leading to unauthorized actions such as the deletion of workflows and exposure of sensitive tokens. This discovery not only underscores a novel attack vector in AI security but also signals a critical shift in how AI agents interact and the potential risks embedded within these layered architectures.
Dispatch Layer: The Hidden Weak Link
Major AI platforms are vulnerable because their dispatch layers blindly trust tool-call data, letting attackers bypass all model-level controls and directly access powerful system tools.
The CoreBreak vulnerability class exposes a critical and widespread dispatch layer flaw across major AI agent platforms including AWS Bedrock, Google ADK, and Vercel AI SDK. These platforms share a fundamental architectural weakness: their dispatch layers accept tool-call-formatted data without verifying its provenance, implicitly trusting that such data is always generated by the model. This oversight allows attackers to bypass the model entirely and invoke tools directly, undermining the core assumption that the model mediates all tool executions and effectively creating a backdoor into agent runtimes.
Unlike traditional prompt injection attacks that manipulate model outputs or contexts, CoreBreak represents a structural failure at the plumbing level of AI agents, specifically targeting the dispatch layer. This distinction is crucial because it renders model-level defenses—such as system prompts, refusal training, and content filters—structurally irrelevant, as attackers can circumvent the model altogether. The vulnerability thus challenges existing AI security paradigms by exposing the agent harness as a high-value attack surface that current protections do not adequately guard.
The severity and pervasiveness of these dispatch layer vulnerabilities are underscored by multiple CVEs assigned across platforms: CVE-2026-18830 for AWS Bedrock (CVSSv4 8.6, High), CVE-2026-18236 for Google ADK (CVSSv4 9.3, Critical), and CVE-2026-64650/64651 for Vercel AI SDK (CVSSv4 6.3, Medium). These ratings reflect the critical nature of the flaws and the urgent need for comprehensive mitigation strategies that go beyond surface-level fixes, acknowledging the systemic trust issues within agent runtimes.
Effective mitigation of CoreBreak vulnerabilities demands deep inspection and verification mechanisms at the dispatch and authorization layers, including cryptographic or logical binding of tool executions to verified model turns. Reliance on model I/O logs alone is insufficient, as the dispatch layer operates beneath the model’s visibility. AWS’s resolution of CVE-2026-18830 by implementing server-side input validation to reject unauthorized tool-use content blocks exemplifies the kind of rigorous, server-level controls necessary to secure this foundational layer of AI agent infrastructure.
Legacy Flaws Threaten AI Infrastructure
Classic vulnerabilities like insecure deserialization have resurfaced in modern AI frameworks, enabling attackers to compromise entire agent ecosystems despite advanced model safeguards.
The CoreBreak vulnerabilities uncovered by Check Point reveal a troubling resurgence of classic security flaws such as insecure deserialization within AI agent frameworks like LangChain, LangGraph, and Google ADK. Despite the rapid adoption of these frameworks across enterprise and financial sectors, their security maturity lags significantly behind, echoing decades-old software vulnerabilities that now threaten the integrity of AI infrastructure. As Shahar Tal from Check Point emphasizes, these legacy issues enable attackers to instantiate arbitrary Python classes during deserialization, effectively compromising the entire agent ecosystem.
These systemic dispatch layer flaws fundamentally undermine current AI security paradigms, which predominantly focus on safeguarding model reasoning and preventing prompt injection. Check Point’s research demonstrates that attackers can bypass sophisticated model-level defenses by exploiting vulnerabilities in the communication and execution layers between agents, a boundary often mistakenly trusted as secure. This shift exposes a critical blind spot: even if model guardrails remain intact, the underlying framework plumbing—responsible for dispatching and orchestrating AI tasks—remains a hostile environment ripe for exploitation.
