New Agent Harness Vulnerabilities Force Rethink of AI Application Security on AWS

Recent disclosures have brought to light a significant new class of vulnerabilities affecting AI agentic workflows, particularly within Amazon Bedrock AgentCore. The CoreBreak research by Phantom Labs identified CVE-2026-18830 and CVE-2026-18953, revealing critical flaws in how AI agents interact with their tools and environments. CVE-2026-18830, with a CVSS v4.0 score of 8.6, involved a failure in the dispatch layer of the AgentCore harness. This allowed an authenticated remote user to inject tool-use content blocks directly into the agent's event loop, bypassing model mediation and its associated security controls. Essentially, the agent executed actions without the model's authorization. AWS addressed this by patching AgentCore before July 31, 2026, implementing server-side input validation to reject malicious tool-use content. Additionally, CVE-2026-18953, also rated 8.6 CVSS v4.0, exposed a path traversal vulnerability in Amazon `awslabs.aws-transform-mcp-server` versions 0.1.0 through 0.1.4. This flaw permitted actors to write arbitrary files outside the intended working directory via the `get_resource` tool's `savePath` parameter. While a more conventional vulnerability, its presence within the Managed Control Plane (MCP) ecosystem—the protocol layer connecting agents to external tools—underscores the broadened attack surface. Users are advised to upgrade to version 0.1.5 or later to mitigate this risk. These findings are not isolated incidents but signal a structural shift in AI application security. For cloud and DevOps practitioners, this means the 'agent harness'—the orchestration layer that manages agent interactions and tool execution—must now be considered a critical security boundary. Traditional security models often focus on securing the AI model itself or the data it processes. However, these vulnerabilities demonstrate that the infrastructure responsible for dispatching and executing agent commands can be exploited independently, leading to unauthorized actions even if the model's logic is sound. The implication is profound: the system cannot rely on the model alone to police its own tool calls; the underlying infrastructure must independently verify the provenance and legitimacy of every instruction. This trend parallels the evolution of container security, where initial focus on container images expanded to securing container orchestration platforms like Kubernetes. As AI agents gain more autonomy and integrate deeply into operational workflows, the attack surface naturally extends to their control planes and interaction mechanisms. The CoreBreak research further highlighted this systemic issue by identifying similar harness-layer bypasses in other platforms such as the Google ADK and Vercel AI SDK, indicating that this is an industry-wide challenge, not specific to AWS. This broader context emphasizes the need for a paradigm shift in how we approach the security of intelligent applications. In practice, practitioners must elevate the agent harness to a security-critical component within their threat models. This means moving beyond solely relying on prompt engineering or model-level guardrails. Concrete actions include implementing stringent, independent verification of instructions at the dispatch layer, ensuring robust input validation and output sanitization for all agent-tool interactions, and applying the principle of least privilege to agent execution environments. Organizations should actively monitor for new research and advisories related to AI agent security, as this domain is rapidly evolving. Furthermore, considering agent sandboxing and blast-radius isolation techniques becomes paramount to limit the potential impact of a compromised agent. The ultimate goal is to secure the entire chain of trust, from the agent's intent to its executed action, by hardening the infrastructure that mediates these processes.