Here is the data: three major AI Agent platforms — AWS Bedrock AgentCore, Google ADK, and Vercel AI SDK — all shipped the same fundamental design flaw. They trusted the format of a tool call over its origin. The dispatch layer, the part that routes model outputs to actual tools, assumed that any data resembling a tool call must have come from a validated model turn. That assumption is now dead. CoreBreak (CVE-2026-18830, CVE-2026-18236, and two Vercel CVEs) turns that trust into a weapon. Attackers can inject arbitrary tool calls directly into the dispatch layer, bypassing the model entirely. No prompt injection. No jailbreak. Just a correctly formatted JSON blob that the infrastructure treats as gospel.
For the crypto AI agent ecosystem — trading bots, DeFi agents, smart contract automation — this is a systemic risk event. These agents are not just chatbots; they execute on-chain transactions, move funds, interact with protocols. If an attacker can forge a tool call to an agent’s swap function, or to a multi-sig signing module, the consequences are not theoretical. They are P&L real. Over the past 7 days, the chatter on security-focused Telegram channels has shifted from “which model is best” to “how do we verify the dispatch layer.” The chop market is positioning for a new risk vector. I’ve seen this pattern before — in 2022, when Terra’s collapse reset leverage, the smart money moved to capital preservation. Now, the smart money is moving to audit the agent infrastructure.
— Scenario: Reacting to a hack in an “Oh, that’s clever” tone while already mentally calculating the market dislocations.
Context: Why Agent Infrastructure Matters for Crypto
Let’s be clear: AI agents are not a toy. They are becoming the execution layer for crypto. Trading bots that use LLMs to parse market sentiment and execute trades. DeFi agents that rebalance positions, arbitrage across DEXs, or manage yield strategies. Smart contract auditors that automatically generate and run tests. All of these rely on the same architecture: model → dispatch → tool execution. The model generates output, often in a structured format like JSON. The dispatch layer parses that output and calls the appropriate tool — a database query, an API call, a blockchain transaction.
CoreBreak attacks the dispatch layer. It does not care about the model’s alignment. It does not care about system prompts. It simply sends a well-formed tool call to the dispatch layer, pretending to be the model. The dispatch layer, lacking any origin verification, executes it. Three platforms confirmed this blind spot. AWS AgentCore (CVSS 8.6), Google ADK (CVSS 9.3 — Critical), Vercel AI SDK (CVSS 6.3 x2). The Google ADK case is particularly nasty: it allows forging a human approval confirmation. That means the attacker can bypass the human-in-the-loop safety net. For a crypto trading agent that requires human approval for large trades, this is a direct path to unauthorized liquidation.
Based on my own experience auditing the EigenLayer restaking protocol in early 2023, I learned that technical literacy in the underlying infrastructure is the only way to trust the yield. The same principle applies here. You cannot trust an agent’s output if you don’t understand its dispatch layer. The crypto community has been obsessed with model-level security — prompt injection, jailbreaks, alignment. CoreBreak shows that the model is not the weakest link. The dispatch layer is.
Core: The Anatomy of the Trust Gap
CoreBreak is not a simple code bug. It is an architectural trust verification gap. The dispatch layer implicitly trusts that any data with the correct format (e.g., a JSON object with a “tool_call” field) must have originated from a validated model turn. This assumption collapses in a distributed system where multiple components write to the same message queue, or where session history can be poisoned. The attack surface is clear:
- Remote injection: An attacker with API access (or authenticated AWS credentials, in the AWS case) can send a tool call directly to the agent’s dispatch endpoint. The model is never invoked. The dispatch layer executes the injected tool call as if it came from the model.
- Session history poisoning: For agents that maintain conversation history, an attacker can inject malicious tool call entries into the history store. When the agent resumes, the dispatch layer reads the history and executes the injected calls.
- Supply chain infiltration: If an attacker can compromise a third-party tool that the agent connects to, they can return malicious tool call data that the dispatch layer will trust.
The three platforms’ CVSS scores reveal the attack surface differences. Google ADK’s 9.3 is critical because it directly defeats human oversight. AWS’s 8.6 is high but requires authenticated access. Vercel’s 6.3 is medium but involves sandbox escape scenarios. The key takeaway: the severity correlates with the depth of the trust chain broken. Google ADK breaks the outermost layer — human trust. AWS breaks the model-to-dispatch trust. Vercel breaks the sandbox isolation.
The fix for all three platforms is essentially the same: add model turn verification. Ensure that the dispatch layer only executes tool calls that are cryptographically bound to a specific model output. AWS deployed an automatic fix in their managed service — users did nothing. Google ADK released version 2.5.0 requiring manual upgrade. Vercel patched with version 1.0.29 / 1.0.28. The difference in response reflects the business model: managed vs. self-hosted. For crypto projects running self-hosted agent frameworks (LangChain, AutoGen, CrewAI), the risk of running unpatched versions is high. No one is patching your agent for you.
Contrarian: The Crypto AI Agent Hype Is the Problem
Here’s the contrarian angle: the crypto community is rushing to deploy AI agents without understanding the underlying infrastructure. We see projects launching “AI-powered trading bots” that use LLMs to generate signals. But the dispatch layer — the part that actually executes the trade — is a black box. Most projects do not publish their dispatch layer architecture, let alone a security audit of it. The assumption is that if the model is secure, the agent is secure. CoreBreak dismantles that assumption.
The blind spot is not just technical. It’s economic. The current market cycle is rewarding narratives over security. AI agent tokens are pumping. But the smart money is already rotating into security infrastructure — agent firewalls, model turn verification tools, dispatch layer auditors. I’ve seen this movie before. In 2020, DeFi yields were high, but the protocols that survived the 2022 crash were those that prioritized security audits and insurance. The same will happen to AI agent platforms. The ones that invest in infrastructure-level security will retain enterprise and institutional capital. The ones that rely on model-level safety alone will bleed out.
Another blind spot: the MCP protocol (Model Context Protocol) is becoming the de facto standard for agent tool interoperability, but it does not mandate origin verification. CoreBreak shows that the protocol itself is vulnerable. If the standard does not include a field for “model turn signature,” then every implementation is vulnerable by design. The industry needs to push for a new primitive: Model Turn Binding Verification (MTBV). Without it, the entire agent ecosystem is built on a trust assumption that is already broken.
Takeaway: Actionable Levels for the Next 90 Days
Let’s be clear: the next 90 days will separate the resilient agents from the vulnerable ones. If you are building or using a crypto AI agent, you need to:
- Audit your dispatch layer. Identify where tool calls are parsed and executed. Is there any verification that the call came from a model output? If not, assume it is vulnerable.
- Demand model turn verification. If your agent framework (LangChain, CrewAI, etc.) does not support cryptographic binding between model outputs and tool calls, either add it or switch to a provider that does.
- Monitor for unverified tool executions. Traditional I/O logging is not enough. You need to log the entire tool call chain, including the origin proof. Unexpected tool executions without a model turn signature are red flags.
- Update immediately. If you are using Google ADK, upgrade to 2.5.0. If you are using Vercel AI SDK, upgrade to 1.0.29/1.0.28. AWS users are already patched, but verify your setup.
The market is sideways, but the positioning is happening now. The chop is for those who are ready to move when the direction becomes clear. The direction is clear: agent security is the new alpha. Those who understand the dispatch layer will profit. Those who ignore it will be the exit liquidity.
— Scenario: Reacting to a hack in an “Oh, that’s clever” tone while already mentally calculating the market dislocations.
Based on my experience stress-testing an AI-agent platform in 2025, I learned that technology cannot replace human oversight in high-stakes environments. CoreBreak is the proof. The human must set the risk parameters, and those parameters must include verification of every tool call’s origin. The era of implicit trust in agent infrastructure is over.