The chart didn't – the infrastructure did.
In July 2026, three major AI agent platforms silently patched a vulnerability class that allows attackers to execute arbitrary tool calls without model approval. AWS Bedrock AgentCore, Google ADK, and Vercel AI SDK all shipped fixes for what researchers labelled CoreBreak. The CVSS scores tell the story: 9.3 for Google ADK, 8.6 for AWS, 6.3 for Vercel. But the real score is in the attack surface – every DeFi trading bot, every automated yield optimizer, every on-chain agent that relies on model-gated tool execution is exposed.
Context: The Agent Infrastructure Blind Spot
I've spent years auditing DeFi smart contracts. The pattern is always the same: a trust assumption that an external call is valid because it came from a trusted source. CoreBreak is the same flaw, but at the AI agent layer. The dispatch layer – the middleware that routes tool calls from the model to execution – assumes that any properly formatted tool call must have been generated by the model. That's a false premise. Attackers can inject tool calls directly into the dispatch layer, bypassing the model entirely. No prompt injection needed. No model jailbreak. Just a well-crafted payload that matches the expected format.
These agents are increasingly used in crypto: automated trading strategies, portfolio rebalancing, cross-chain arbitrage. They connect to wallets, exchanges, and smart contracts. If an attacker can inject a tool call into a user's agent session, they can drain funds, execute trades, or deploy malicious contracts – all without the model ever approving the action.
Core: The Order Flow Analysis
CoreBreak is not a single bug. It's a systemic trust gap. The three affected platforms each have a different attack vector, but they share the same root cause: the dispatch layer does not verify that a tool call originated from a model turn. It only checks the format.
CVE-2026-18830 (AWS Bedrock AgentCore, CVSS 8.6): Remote attacker with authenticated API access can inject tool use content blocks. The attacker doesn't need to be the model user – any authenticated API caller can push a payload that the dispatch layer will execute. In a DeFi context, this means a compromised API key or a malicious third-party integration can trigger arbitrary tool execution.
CVE-2026-18236 (Google ADK, CVSS 9.3): The most dangerous. The attacker can forge a human approval confirmation. The ADK's confirmation handler trusts that a tool call with a matching format was approved by a human. No actual human approval is needed. If your DeFi agent requires human-in-the-loop for high-value trades, this vulnerability bypasses that safeguard entirely. The attacker can drain a wallet and the system logs will show a false human approval.
Vercel AI SDK (CVE-2026-18836 and CVE-2026-18837, CVSS 6.3 each): These require local sandbox escape first, but once inside, the vulnerabilities allow path traversal and tool injection. For DeFi agents running in Vercel's edge functions, an attacker who compromises the sandbox can escalate to full agent control.
The cross-platform replication is the tell. This isn't a developer oversight. It's a design paradigm failure. The dispatch layer was built to be fast, not secure. It trusts the model's output format as a proxy for authenticity. That's like trusting a check because it has the correct numbers, without verifying the signature.
Contrarian: The Retail Blind Spot
The market is obsessed with prompt injection. Retail traders panic when they hear about model jailbreaks. They think, "My agent uses a secure model, so my funds are safe." That's wrong. CoreBreak doesn't target the model. It targets the pipe between the model and the action. You can have the most aligned, most robust model in the world, and it won't stop an attacker who skips the model entirely.
I've seen this pattern before. In DeFi, smart contracts often assume that an external call is safe because it comes from a known address. Reentrancy attacks exploit that trust. CoreBreak is the reentrancy of AI agents. The dispatch layer is the vulnerable external call. The attacker is the malicious contract.
Retail also thinks managed platforms like AWS Bedrock are safer because of "security shared responsibility." But the vulnerability was in the platform itself. AWS's auto-fix was a business advantage, but it doesn't change the fact that the flaw existed. Self-hosted users of Google ADK and Vercel have to manually upgrade and audit their infrastructure. Most won't. The exposure window is long.
Code is law, until it isn't. The dispatch layer's code assumes tool calls are model-generated. That assumption is the law. CoreBreak proves it's not enforceable.
Takeaway: Actionable Levels
If you use an AI agent for DeFi, you have two options. First, use a managed platform that guarantees model turn binding – AWS's auto-fix is a step, but verify their implementation. Second, add an independent verification layer: a middleware that checks every tool call against the model's signed output. This is the equivalent of a multi-sig wallet for agents.
Risk isn't a feeling. It's a measurable gap between the model's turn and the tool's execution. CoreBreak is that gap. The chart didn't show it, but the infrastructure did. Now you know. Act accordingly.
Every candle tells a story of fear. This one is about the fear of silence – the tool call that executes without the model's knowledge. Don't let your agent be the next victim.