The control point in AI agents is no longer the model prompt. In these flaws, forged tool calls could reach dispatch logic without a legitimate model turn, so the safety layer you expected to approve action never actually got a vote.
The report ties that pattern across Amazon Bedrock AgentCore’s InvokeHarness API, Google’s ADK for Python, and Vercel’s AI SDK harnesses for Codex and OpenCode. AWS fixed the managed service, Google issued ADK 2.5.0, and Vercel patched @ai-sdk/harness-codex 1.0.29 and @ai-sdk/harness-opencode 1.0.28.
The same shift shows up in related testing incidents and token-jacking cases: once agents hold API keys or can reach outside systems, stolen tokens and model escapes turn the agent’s own reach into the blast radius. Prompt hardening does not cover that failure mode.