Executive Summary
Flaws in agent infrastructure from AWS, Google and Vercel let untrusted or forged instructions reach an agent's tools without a model turn authorizing them, so system prompts and guardrails never ran.
What Happened
Security flaws in agent infrastructure from Amazon Web Services (AWS), Google, and Vercel let untrusted or forged instructions reach an agent's tools with no check that a model turn had authorized them. In several of the attack paths, the model never ran at all, so system prompts, content filters, and model-level guardrails never got a chance to intervene. The affected products include Amazon
Affected Products
- Amazon Web Services agent infrastructure
- Google agent infrastructure
- Vercel agent infrastructure
Vulnerability / Attack Technique
Forged tool calls bypassing the model
Technical Mechanism
The infrastructure accepted tool invocations without checking that the model had produced them, so attackers could call tools directly.
AI Security Category
LLM06:2025 Excessive Agency
Part of the AI Agent Excessive Agency topic.
Relevant Frameworks
RealGround Analysis
Model-level guardrails are useless if tools can be called without the model. RealGround analysis: tool endpoints need their own authentication and authorization.
Recommended Controls
- Authenticate and authorize every tool call at the tool
- Apply vendor fixes
- Log tool calls with the model turn that requested them
Related RealGround Service
Secure AI Agent Build · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/08/aws-google-and-vercel-patch-agent-flaws.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.