Researchers Find AI Agents at AWS, Google and Vercel Can Be Tricked Into Running Tools Without the AI

Key points

• Security researchers found flaws in AI agent infrastructure from Amazon Web Services, Google, and Vercel that let attackers trigger the agent's tools without going through the AI model.
• In several attack paths, the AI model itself never ran, so system prompts, content filters, and model-level safety rules had no chance to block the action.
• Affected products span Amazon Bedrock AgentCore, Google's Vertex AI agent stack, and Vercel's AI SDK, according to the disclosure first reported by The Hacker News.
• The bugs sit in the wiring around the model, not the model itself, meaning traditional AI guardrails do not help.
• All three vendors have issued fixes or guidance; developers building agents on these platforms should update immediately.

An AI agent is a program that uses a large language model to decide what to do, then calls real tools on your behalf: sending emails, querying databases, running code, moving money. The safety story vendors tell goes like this. A user asks the agent to do something. The model reads the request, applies its safety rules, and only then picks a tool to run.

New research shows that story has a hole in it.

Security researchers found that on agent platforms from Amazon Web Services, Google, and Vercel, an attacker can smuggle instructions into the agent's plumbing that reach the tools directly. The model, the part with the safety training, is skipped. So are the system prompt, the content filters, and any model-level guardrail the vendor bolted on.

Put plainly: the bouncer is on the door, but there is a side entrance no one is watching.

How does the attack actually work?

The flaws sit in the code that shuttles messages between the user, the model, and the tools. That layer trusts what it is handed. If an attacker can plant a forged "model turn", a message that looks like the AI's own decision to call a tool, the infrastructure runs it. No check confirms the model actually authorised that call.

In some of the attack paths, the model was never invoked at all. The tool just ran.

That matters because every safety measure vendors advertise, refusal training, prompt filtering, content policies, lives inside the model. Route around the model and none of it applies.

Which products are affected?

The disclosure names agent frameworks at three major vendors:

All three vendors have responded with patches or configuration guidance. If your team is building on any of these stacks, treat this as a same-week upgrade.

Why is this different from prompt injection?

Prompt injection, where an attacker hides instructions in a webpage or document that the AI then reads, at least goes through the model. The model sees the malicious text and, in theory, its safety training might refuse.

These flaws are worse. The attack does not argue with the model. It bypasses it. That is closer to a classic authentication bug than a novel AI problem, and it is a reminder that agent security is mostly boring backend security wearing an AI hat.

What should teams building on these platforms do?

Apply the vendor updates from AWS, Google, and Vercel now. Audit any custom agent code that assembles or forwards model messages: if your code accepts a "tool call" from anywhere other than a freshly returned model response, that is the bug class. Log every tool invocation with the model turn that authorised it, so a mismatch is visible after the fact.

For everyone else, the practical takeaway is smaller but real. If you use an AI assistant at work that can take actions, sending mail, filing tickets, touching customer data, ask your IT team which agent framework it runs on and whether these advisories have been applied. The safety label on the model is not the whole safety story.