AWS, Google, and Vercel AI Agent Flaws Bypass Model Guardrails — Detection and Hardening Guide

---
title: Direct Tool Invocation on AI Agent Endpoint Without Model Turn
tid: 3f7c2a91-6b4d-4e8a-9c1f-2d5e8a7b9c01
status: experimental
description: Detects HTTP requests hitting AI agent tool-invocation endpoints with tool-call payloads, which may indicate forged instructions reaching tools without a model turn, as disclosed in AWS/Google/Vercel agent framework flaws.
references:
  - https://thehackernews.com/2026/08/aws-google-and-vercel-patch-agent-flaws.html
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_paths:
    cs-uri-stem|contains:
      - '/api/chat'
      - '/api/agent'
      - '/api/tools'
      - '/tool/invoke'
      - '/tools/call'
      - '/api/function'
  selection_payload:
    cs-body|contains:
      - '"tool_calls"'
      - '"tool_call_id"'
      - '"function_call"'
      - '"toolInvocations"'
      - '"name":"execute"'
  condition: selection_paths and selection_payload
falsepositives:
  - Legitimate client-side agent UI traffic from the Vercel AI SDK useChat hook posts tool results to the chat endpoint; baseline your application routes and restrict to requests missing expected session cookies or originating from unusual sources
level: high
---
title: Agent Runtime Process Spawning Shell or Script Interpreter
tid: 8b1e4d62-9a3f-4c7b-b5e2-6f0a1c3d5e78
status: experimental
description: Detects Node.js or Python agent runtimes spawning shells or script interpreters, consistent with abused tool executions achieving command execution after guardrail bypass in AI agent frameworks.
references:
  - https://thehackernews.com/2026/08/aws-google-and-vercel-patch-agent-flaws.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\node.exe'
      - '\python.exe'
      - '\python3.exe'
      - '\bun.exe'
      - '\deno.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\certutil.exe'
      - '\curl.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Build tooling and developer workstations running Node-based CLIs; restrict to production agent service accounts and server workloads
level: high
---
title: Suspicious Tool or Function Invocation in AWS CloudTrail Without Preceding Model Call Context
tid: 5c9a3f71-2e8d-4b6a-a1c4-7d0e2f8b3a45
status: experimental
description: Detects Lambda function invocations or Bedrock agent action executions in CloudTrail originating from atypical user agents or unauthenticated contexts, which may indicate forged tool invocations against AWS agent infrastructure.
references:
  - https://thehackernews.com/2026/08/aws-google-and-vercel-patch-agent-flaws.html
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  product: aws
  service: cloudtrail
detection:
  selection_events:
    eventSource:
      - 'lambda.amazonaws.com'
      - 'bedrock.amazonaws.com'
    eventName:
      - 'Invoke'
      - 'InvokeAgent'
      - 'InvokeModel'
  selection_anomaly:
    userAgent|contains:
      - 'curl'
      - 'python-requests'
      - 'axios'
      - 'node-fetch'
      - 'Go-http-client'
  condition: selection_events and selection_anomaly
falsepositives:
  - Legitimate SDK-based automation uses similar user agents; correlate with expected invocation sources, VPC endpoints, and known deployment pipelines before escalating
level: medium

// Hunt: Tool executions on AI agent endpoints with NO preceding model API call
// Requires application/web logs ingested into Sentinel (e.g., via AzureMonitor or custom logs)
// Adjust table/field names to your ingestion schema.
let window = 5m;
let ToolCalls =
    AzureDiagnostics
    | where TimeGenerated > ago(24h)
    | where requestUri_s has_any ("/api/chat", "/api/agent", "/api/tools", "/tool/invoke")
    | where httpMethod_s == "POST"
    | extend ClientIP = clientIP_s, URI = requestUri_s, ToolTime = TimeGenerated;
let ModelCalls =
    AzureDiagnostics
    | where TimeGenerated > ago(24h)
    | where requestUri_s has_any ("completions", "generateContent", "converse", "InvokeModel")
    | extend ModelTime = TimeGenerated, ModelClient = clientIP_s;
ToolCalls
| join kind=leftanti (
    ModelCalls
    | where ModelClient == ClientIP
    | where ModelTime between (ago(window) .. now())
) on $left.ClientIP == $right.ModelClient
| project ToolTime, ClientIP, URI, httpStatus_d, userAgent_s
| order by ToolTime desc;
// Secondary hunt: AWS Bedrock/Lambda invocations from non-SDK user agents (CloudTrail via CEF/Syslog ingestion)
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceProduct has "CloudTrail" or AdditionalExtensions has "cloudtrail"
| where RequestContext has_any ("bedrock", "lambda") and RequestContext has "Invoke"
| where ApplicationProtocol has_any ("curl", "python-requests", "axios", "Go-http-client")
   or AdditionalExtensions has_any ("curl", "python-requests", "axios")
| project TimeGenerated, SourceIP, RequestContext, ApplicationProtocol, AdditionalExtensions
| order by TimeGenerated desc;
// Tertiary hunt: agent runtime processes spawning shells (Defender for Endpoint)
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessFileName in~ ("node.exe", "node", "python.exe", "python", "python3", "bun", "deno")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "sh", "bash", "curl", "wget")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| order by TimeGenerated desc;

-- Hunt for AI agent runtimes (Node/Python) with active network connections
-- and shell-like child processes, consistent with tool-invocation abuse
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)^(node|python|python3|bun|deno)'
  AND CommandLine =~ '(?i)(next|server|agent|ai-sdk|langchain|vertex|bedrock)'

-- Correlate agent processes with outbound connections to unusual destinations
SELECT Pid, Name, CommandLine, netstat().RemoteAddress AS RemoteAddr,
       netstat().RemotePort AS RemotePort, netstat().Status AS ConnStatus
FROM pslist()
WHERE Name =~ '(?i)(node|python|bun|deno)'
  AND netstat().Status =~ 'ESTABLISHED'
  AND netstat().RemotePort in (80, 443, 8080, 8443)

-- Find shells spawned by agent runtimes (command execution after guardrail bypass)
SELECT child.Pid, child.Name AS ChildName, child.CommandLine AS ChildCmd,
       parent.Name AS ParentName, parent.CommandLine AS ParentCmd,
       child.Username, child.CreateTime
FROM pslist() AS child
JOIN pslist() AS parent ON child.Ppid = parent.Pid
WHERE parent.Name =~ '(?i)(node|python|bun|deno)'
  AND child.Name =~ '(?i)(cmd|powershell|pwsh|sh|bash|curl|wget|nc)'

#!/bin/bash
# audit-agent-frameworks.sh — Verify AI agent framework versions in deployed apps
# Run from the application root or against a list of project directories.

TARGETS=("${@:-.}")

echo "=== AI Agent Framework Version Audit ==="
echo "Compare output against vendor advisories before marking compliant."
echo

for DIR in "${TARGETS[@]}"; do
  echo "--- Scanning: $DIR ---"

  # Node.js: Vercel AI SDK and related packages
  if [ -f "$DIR/package.json" ]; then
    echo "[Node] Dependencies in $DIR/package.json:"
    grep -E '"(ai|@ai-sdk|@vercel|langchain|@langchain|llamaindex)[^"]*"\s*:' "$DIR/package.json" || echo "  No known agent packages found."
  fi

  # Locked versions are what actually ship
  if [ -f "$DIR/package-lock.json" ]; then
    echo "[Node] Locked versions:"
    grep -oE '"node_modules/(ai|@ai-sdk/[a-z-]+|@vercel/[a-z-]+)":' "$DIR/package-lock.json" | sort -u
  fi

  # Python: agent frameworks commonly used with AWS Bedrock / Google Vertex
  if command -v pip >/dev/null 2>&1; then
    echo "[Python] Installed agent-related packages:"
    pip list 2>/dev/null | grep -iE 'google-adk|vertexai|langchain|llama-index|strands|bedrock|boto3|google-generativeai' || echo "  None found in current environment."
  fi
  echo
done

echo "=== Next Steps ==="
echo "1. Compare each version to the latest patched release in the vendor advisory."
echo "2. For Vercel AI SDK: https://github.com/vercel/ai/security/advisories"
echo "3. For AWS: https://aws.amazon.com/security/security-bulletins/"
echo "4. For Google: https://cloud.google.com/support/bulletins"
echo "5. Rebuild and redeploy — updating package.json alone does not patch running services."