Critical security vulnerabilities have been identified in AI agent infrastructure provided by Amazon Web Services, Google, and Vercel that allow attackers to bypass authorization controls and send malicious instructions directly to agent tools. The flaws enable untrusted or forged commands to reach backend systems without verification that an AI model had authorized the actions.
The vulnerabilities represent a fundamental breakdown in the security architecture of these AI agent platforms. In multiple attack scenarios documented by researchers, malicious instructions can bypass the AI model entirely, meaning protective measures like system prompts, content filters, and model-level guardrails never activate. This creates a direct path for attackers to manipulate agent behavior without any of the safety mechanisms that developers typically rely on to constrain AI system actions.
The technical root cause centers on insufficient validation of instructions flowing between the AI model and the tools or functions that agents can invoke. When an agent receives instructions, the affected platforms fail to verify that those instructions originated from a legitimate model inference cycle. Attackers can exploit this gap by crafting requests that appear to come from the model but actually bypass it completely, or by injecting forged authorization tokens that the infrastructure accepts without proper validation.
The impact extends to any organization using these platforms to deploy AI agents with access to sensitive tools, databases, or external systems. Successful exploitation could allow attackers to execute unauthorized database queries, modify system configurations, access confidential data, or trigger actions in connected services. The severity is heightened because these attacks circumvent the security controls that organizations implement at the model level, creating a false sense of security.
Organizations running AI agents on AWS, Google, or Vercel platforms should immediately audit their agent implementations to understand which tools and permissions are exposed. Security teams should implement additional authorization checks at the tool level rather than relying solely on model-level controls, apply any security patches released by the vendors, and consider adding logging and monitoring to detect suspicious tool invocations that bypass normal model interaction patterns. Until patches are fully deployed, limiting agent tool permissions to the minimum necessary scope can reduce potential exposure.
Source: https://thehackernews.com/2026/08/aws-google-and-vercel-patch-agent-flaws.html