CoreBreak proves agent guardrails must live outside the agent

Researchers at Black Hat 2026 disclosed CoreBreak, a class of flaws affecting AWS Bedrock AgentCore with Strands, Google’s Agent Development Kit, and Vercel’s AI SDK harness that allowed attacker-supplied message histories to trigger tool calls or forge approval events without model-based guardrails being invoked; the vendors issued patches for related CVEs. The article argues that these incidents expose limitations in security controls embedded within an agent’s prompts, model behavior, or message history, because such controls can be bypassed when execution is initiated outside normal model turns. It advocates out-of-band policy enforcement (OBPE), in which tool execution, identity, policy decisions, and approvals are handled through an external typed boundary that agents cannot alter or forge. Redpanda presents its Agentic Data Plane as an implementation of this approach and cites its own experiments across 3,621 trials, reporting substantially lower failure rates for agents protected by OBPE than for prompt-only controls or reviewer models. The discussion also notes that external policy boundaries do not address every risk, particularly general-purpose execution environments with accessible cloud credentials, and concludes that agent systems handling sensitive data should separate authorization and approval mechanisms from the agents they govern.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.