AWS, Google and Vercel Agent Flaws Let Attackers Trigger Tools Without Running the Model

Three separate research groups (Pillar and partners) disclosed that agent infrastructure from AWS (Bedrock AgentCore), Google (ADK) and Vercel (AI SDK harnesses) allowed untrusted or forged instructions to reach agent tools without the model ever running — meaning system prompts, content filters and model guardrails were bypassed entirely.

This is a fundamental agent-infrastructure flaw: it lets an attacker trigger tool actions while circumventing the model-and-guardrail layer entirely, independent of any prompt-injection in the LLM itself.

Source

• The Hacker News — agent tool flaws