Nobody clapped for this one. Zero points, zero comments on HN, and yet CVE-2026-18830 is a better predictor of where agentic AI security is headed in the next two years than most of the funded-startup noise clogging your feed.
Context
Here's the setup: AWS Bedrock AgentCore had a flaw where authenticated users could forge tool-use content blocks that got executed without the model ever actually authorizing them. The LLM is supposed to be the gatekeeper deciding "yes, call this tool" or "no, don't." Turns out you could just skip the gatekeeper and hand the harness a forged instruction that looked legitimate enough to run.
If that sounds familiar, it should. This is the same shape of bug we've been fixing since the 90s: a system trusts input that crosses a trust boundary without validating where it actually came from. Swap "SQL query" for "tool-use block" and "database" for "agent runtime" and you've got the exact same root cause as injection attacks from two decades ago. The researchers who found this weren't wrong to flag it as a distinct pattern worth naming, but let's not pretend the underlying mechanism is some novel AI-era mystery. It's a parser trusting a payload it shouldn't.
What makes this genuinely interesting isn't the AWS bug in isolation. It's that the same bypass pattern turned up in Google ADK and Vercel AI SDK too. Three separate vendors, three separate implementations, same architectural mistake. That's not a coincidence, that's convergent evolution. Everyone building agent harnesses is solving the same problem (how do you let an LLM safely trigger real-world actions) and apparently a lot of them are solving it the same insecure way.
