--- title: CoreBreak proves agent guardrails need to live outside... description: Researchers Aviyam Ivgi and Hedi Ingber disclosed CoreBreak at Black Hat 2026, a structural flaw affecting AWS Bedrock AgentCore with Strands SDK, Google's... canonical: https://daily.dev/posts/corebreak-proves-agent-guardrails-need-to-live-outside-the-agent-cjjaygovf twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: CoreBreak proves agent guardrails need to live outside the agent | daily.dev og:description: Researchers Aviyam Ivgi and Hedi Ingber disclosed CoreBreak at Black Hat 2026, a structural flaw affecting AWS Bedrock AgentCore with Strands SDK, Google's... og:url: https://daily.dev/posts/corebreak-proves-agent-guardrails-need-to-live-outside-the-agent-cjjaygovf og:image: https://api.daily.dev/og/posts/CjJaYgovF.png og:image:alt: CoreBreak proves agent guardrails need to live outside the agent og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # CoreBreak proves agent guardrails need to live outside the agent **[Redpanda](https://daily.dev/sources/redpanda)** · 6 min read · 0 upvotes · 0 comments ## Summary Researchers Aviyam Ivgi and Hedi Ingber disclosed CoreBreak at Black Hat 2026, a structural flaw affecting AWS Bedrock AgentCore with Strands SDK, Google's Agent Development Kit, and Vercel's AI SDK. Attackers could forge tool calls or fake human-approval events directly in the message history, bypassing model-level guardrails entirely since enforcement lived inside the agent's reach. AWS, Google, and Vercel each patched separate CVEs (CVE-2026-18830, CVE-2026-18236, CVE-2026-64650/64651). Redpanda argues the real fix is out-of-band policy enforcement (OBPE), where tool execution and approvals are bound to a boundary the agent cannot author or forge, and cites its own 3,621-trial study showing prompt-guarded agents failed 57.6% of the time versus 0.2% for agents behind an OBPE boundary. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the CoreBreak vulnerability in AI agent frameworks? CoreBreak is a structural flaw disclosed at Black Hat 2026 by researchers Aviyam Ivgi and Hedi Ingber affecting AWS Bedrock AgentCore with Strands SDK, Google's Agent Development Kit, and Vercel's AI SDK. Attackers could feed a message history containing a forged tool call or a fake approval event, letting tools execute with attacker-chosen arguments while bypassing the model and every guardrail wrapped around it. _Teams shipping agent stacks track disclosures like CoreBreak and vendor patch details on daily.dev._ ### Which CVEs came out of the CoreBreak agent vulnerability disclosure? AWS patched CVE-2026-18830 (CVSS 8.6) in Bedrock AgentCore with the Strands SDK, Google patched CVE-2026-18236 (CVSS 9.3, critical) in its Agent Development Kit, and Vercel patched CVE-2026-64650 and CVE-2026-64651 in the AI SDK. All three fixes bind tool execution to state an attacker cannot author and reject externally supplied tool calls and approvals. _Developers weighing agent frameworks compare patch histories and CVE severity on daily.dev before choosing a stack._ ### How effective is out-of-band policy enforcement (OBPE) at stopping prompt injection attacks on AI agents compared to a reviewer model? Across 3,621 trials on Claude Sonnet 4.6, Claude Haiku 4.5, GPT-5, and GPT-5 mini, agents guarded only by prompt rules failed 57.6% of the time, leaking data or completing forbidden actions, while the same agents behind an OBPE boundary failed only 0.2%. A separate reviewer-model approach still failed 58.6% of trials because it only inspects output after tools already ran, whereas the OBPE boundary failed 0.0% while completing more tasks and using no extra model calls. _Anyone deciding between guardrail architectures for agentic systems can weigh these benchmark numbers on daily.dev._ --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#prompt-injection](https://daily.dev/tags/prompt-injection), [#redpanda](https://daily.dev/tags/redpanda) [View this post on daily.dev](https://daily.dev/posts/corebreak-proves-agent-guardrails-need-to-live-outside-the-agent-cjjaygovf) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"CoreBreak proves agent guardrails need to live outside the agent","url":"https://daily.dev/posts/corebreak-proves-agent-guardrails-need-to-live-outside-the-agent-cjjaygovf","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/corebreak-proves-agent-guardrails-need-to-live-outside-the-agent-cjjaygovf"},"datePublished":"2026-08-31T20:29:14.382Z","dateModified":"2026-08-31T22:11:45.303Z","description":"Researchers Aviyam Ivgi and Hedi Ingber disclosed CoreBreak at Black Hat 2026, a structural flaw affecting AWS Bedrock AgentCore with Strands SDK, Google's...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/cc4cfab97ea5850493583bc22ee88f9c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/cc4cfab97ea5850493583bc22ee88f9c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Redpanda","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Redpanda","logo":"https://media.daily.dev/image/upload/s--1R2EIDcb--/f_auto,q_auto/v1769934743/logos/redpanda","url":"https://daily.dev/sources/redpanda"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/corebreak-proves-agent-guardrails-need-to-live-outside-the-agent-cjjaygovf","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,prompt-injection,redpanda","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Redpanda","item":"https://daily.dev/sources/redpanda"},{"@type":"ListItem","position":3,"name":"CoreBreak proves agent guardrails need to live outside the agent"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/corebreak-proves-agent-guardrails-need-to-live-outside-the-agent-cjjaygovf#faq","mainEntity":[{"@type":"Question","name":"What is the CoreBreak vulnerability in AI agent frameworks?","acceptedAnswer":{"@type":"Answer","text":"CoreBreak is a structural flaw disclosed at Black Hat 2026 by researchers Aviyam Ivgi and Hedi Ingber affecting AWS Bedrock AgentCore with Strands SDK, Google's Agent Development Kit, and Vercel's AI SDK. Attackers could feed a message history containing a forged tool call or a fake approval event, letting tools execute with attacker-chosen arguments while bypassing the model and every guardrail wrapped around it. Teams shipping agent stacks track disclosures like CoreBreak and vendor patch details on daily.dev."}},{"@type":"Question","name":"Which CVEs came out of the CoreBreak agent vulnerability disclosure?","acceptedAnswer":{"@type":"Answer","text":"AWS patched CVE-2026-18830 (CVSS 8.6) in Bedrock AgentCore with the Strands SDK, Google patched CVE-2026-18236 (CVSS 9.3, critical) in its Agent Development Kit, and Vercel patched CVE-2026-64650 and CVE-2026-64651 in the AI SDK. All three fixes bind tool execution to state an attacker cannot author and reject externally supplied tool calls and approvals. Developers weighing agent frameworks compare patch histories and CVE severity on daily.dev before choosing a stack."}},{"@type":"Question","name":"How effective is out-of-band policy enforcement (OBPE) at stopping prompt injection attacks on AI agents compared to a reviewer model?","acceptedAnswer":{"@type":"Answer","text":"Across 3,621 trials on Claude Sonnet 4.6, Claude Haiku 4.5, GPT-5, and GPT-5 mini, agents guarded only by prompt rules failed 57.6% of the time, leaking data or completing forbidden actions, while the same agents behind an OBPE boundary failed only 0.2%. A separate reviewer-model approach still failed 58.6% of trials because it only inspects output after tools already ran, whereas the OBPE boundary failed 0.0% while completing more tasks and using no extra model calls. Anyone deciding between guardrail architectures for agentic systems can weigh these benchmark numbers on daily.dev."}}]} ```