Security researchers discovered critical bypass vulnerabilities in AI agent frameworks from AWS, Google, and Vercel that allow attackers to invoke tool functions without authorization from the underlying language models. These flaws entirely circumvent safety mechanisms built into the systems.
The vulnerabilities stem from insufficient validation of tool invocation requests within agent infrastructure. Attackers can craft forged instructions that reach agent tools directly, bypassing model authorization checks entirely. In several attack scenarios, the language model never executes at all, rendering system prompts, content filters, and model-level guardrails ineffective.
AWS, Google, and Vercel each implemented agent frameworks designed to let AI models trigger external functions like database queries, API calls, and file operations. The flaws allow untrusted parties to invoke these tools without triggering the model's decision-making layer first. This creates a direct path to sensitive operations that should require explicit model approval.
The impact ranges from moderate to severe depending on the agent's permissions. An attacker exploiting these flaws could execute unauthorized database modifications, access restricted APIs, or manipulate cloud resources if the agent possesses those permissions. Organizations using these frameworks for security-critical tasks face elevated risk.
The attack works because these agent systems trust tool invocation requests without verifying they originated from authenticated model operations. The architecture assumes all requests reaching tools have passed through proper authorization gates. This assumption proves false.
All three vendors have been notified and patches are in development or deployed. Organizations using AWS agents, Google's Vertex AI agent builders, or Vercel's AI SDK should apply updates immediately and audit their agent configurations. Review which cloud permissions and external APIs agents can access, and restrict these to the minimum required for legitimate operations.
This class of vulnerability highlights a broader challenge in AI system design. As models integrate with external tools, the boundary between model decisions and system actions becomes a critical security perimeter. Developers must treat tool