Recently discovered vulnerabilities in the agent infrastructure of Amazon Web Services, Google, and Vercel allowed attackers to trigger agent tools without proper model authorization. The affected products included Amazon Bedrock AgentCore's InvokeHarness API, Google's Agent Development Kit for Python, and Vercel's AI SDK harness packages. Each vendor has since issued patches to address these security concerns. AWS's vulnerability allowed authenticated remote requests to bypass model authorization, which was resolved by implementing server-side validation to reject tampered tool-use blocks. However, AWS's open-source Strands Python code still has a similar flaw, as it relies on customers to manage message history securely. Google addressed its issues in ADK for Python by ensuring unauthorized tool execution could not occur through forged approvals in session history. This was achieved by adding verification checks for tool ownership and requirement of confirmation. Vercel patched its AI SDK harness packages to prevent local sandbox-to-host authorization bypass, which could be exploited through malicious code running inside a sandbox. The patch required exact, short-lived, one-time authorization for tool execution. These fixes are crucial in safeguarding these platforms against potential exploitation and highlight the importance of continuous security assessment in development environments.