Researchers Find AI Agents at AWS, Google and Vercel Can Be Tricked Into Running Tools Without the AI

Key points

• Security researchers found flaws in AI agent infrastructure at Amazon Web Services, Google, and Vercel that let attackers trigger the agent's tools without going through the AI model.
• In several attack paths the AI model never ran, so system prompts, content filters, and model-level safety rules had no chance to block the action.
• Affected products span Amazon Bedrock AgentCore, Google's Vertex AI agent stack, and Vercel's AI SDK, according to a disclosure first reported by The Hacker News.
• The bugs sit in the wiring around the model, not the model itself, meaning traditional AI guardrails don't help.
• All three vendors have issued fixes or guidance; developers building agents on these platforms should update now.

An AI agent is a program that uses a large language model to decide what to do, then calls real tools on your behalf: sending emails, querying databases, running code, moving money. The safety story vendors tell goes like this. A user asks the agent to do something. The model reads the request, applies its safety rules, and only then picks a tool to run. That story has a hole in it.

Researchers found that on these platforms an attacker can smuggle instructions into the agent's plumbing that reach the tools directly. The model, the part with the safety training, is skipped. So are the system prompt and any content filter the vendor bolted on.

There's a side entrance, and nobody's been watching it.

How does the attack actually work?

The flaws sit in the code that shuttles messages between the user and the tools. That layer trusts what it's handed. If an attacker can plant a forged "model turn", a message that looks like the AI's own decision to call a tool, the infrastructure runs it. No check confirms the model actually authorised that call.

In some attack paths the model was never invoked at all. The tool just ran.

That matters because every safety measure vendors advertise, refusal training, prompt filtering, content policies, lives inside the model. Route around the model and none of it applies.

Which products are affected?

The disclosure names agent frameworks at three vendors:

All three vendors have responded with patches or configuration guidance. If your team is building on any of these stacks, treat this as a same-week upgrade.

Why is this different from prompt injection?

Prompt injection, where an attacker hides instructions in a webpage or document that the AI then reads, at least goes through the model. The model sees the malicious text and its safety training might refuse.

These flaws are worse. The attack doesn't argue with the model. It bypasses it entirely. That's closer to a classic authentication bug than a novel AI problem. Our 4 August story on Google's AI coding assistants being manipulated to leak credentials showed what happens when one agent compromises another; this research shows you don't even need an agent in the chain. Agent security, it keeps turning out, is mostly boring backend security wearing an AI hat.

What should teams building on these platforms do?

Apply the vendor updates now. Audit any custom agent code that assembles or forwards model messages: if your code accepts a tool call from anywhere other than a freshly returned model response, that's the bug class. Log every tool invocation with the model turn that authorised it, so a mismatch is visible after the fact.

Should you worry if you're not a developer?

If you use an AI assistant at work that can take actions, sending mail, filing tickets, touching customer data, ask your IT team which agent framework it runs on and whether these advisories have been applied. The safety label on the model isn't the whole safety story. It never was.