At Black Hat 2026, researchers Aviyam Ivgi and Hedi Ingber showed one structural flaw running through three of the largest agent stacks: AWS Bedrock AgentCore with the Strands SDK, Google's Agent Development Kit, and Vercel's AI SDK harness. They named that flaw CoreBreak. AWS patched CVE-2026-18830 (CVSS 8.6), Google patched CVE-2026-18236 (CVSS 9.3, critical), and Vercel patched CVE-2026-64650 and CVE-2026-64651. All three vendors had put enforcement where the agent could reach it.
The guardrails the industry relies on are all wrapped around the model: system prompts, content filters, refusal training. If you bypass the model, you bypass all of them. CoreBreak showed two ways to do exactly that:
1. Feed the harness a message history whose latest message already contains a tool call, and the tool runs with attacker-chosen arguments while the model and every guardrail wrapped around it never fires.
2. Forge an "approved" confirmation event in that same history, and the human-in-the-loop step approves an action that no human saw. The approval mechanism itself became the attack vector.
As the AI infrastructure company Redpanda explores, the emergency fixes all converged on the same move: bind tool execution to a state that the attacker cannot author, and reject externally supplied tool calls and approvals. That's called out-of-band policy enforcement, or OBPE, and each vendor had to rebuild a piece of it under fire, one patch at a time.
The researchers already stated the fix
The researchers' own hardening list reads like a description of OBPE. They called for rejecting caller-authored tool calls, authorizing at execution time, reducing inherited authority, and binding each tool invocation to the exact model event and authorization state that produced it. That is a specification for enforcement outside the agent. The industry's most effective red team and Redpanda’s own research group reached the same conclusion independently.
The credential-theft path CoreBreak exposed is worth highlighting: Injected instructions steered managed browser and code-interpreter tools into reading the execution role's cloud credentials and exfiltrating them. No policy engine changes a sandbox's networking. The lesson is what you hand an agent in the first place. A typed, mediated tool grant keeps the credential behind the boundary. A general compute environment with ambient cloud credentials puts it one HTTP request away from any injected instruction.
Different research, same conclusion
Redpanda published its own research testing a comparable enforcement architecture against a related attack class: prompt-injected agents coaxed into leaking protected data or taking unauthorized actions.
In its benchmark, the researchers ran 3,621 trials across four models (Claude Sonnet 4.6, Claude Haiku 4.5, GPT-5, and GPT-5 mini) to measure this directly. Agents guarded only by prompt rules failed in 57.6% of trials, leaking protected data, revealing protected values, or completing forbidden backend effects. The same agents behind the OBPE boundary failed in 0.2%.
Redpanda also tested the in-band alternative, in which a dedicated reviewer model reads the agent's output and blocks unsafe answers. On Sonnet, the reviewer still failed 58.6% of the time because it reads text after the tools have already run. It can refuse an answer. It cannot unread a record the agent has already absorbed, and it cannot undo a write that already landed.
The OBPE boundary failed 0.0% of those same trials, finished more of the work (66.2% task fulfillment against the reviewer's 58.7%), and tripled safe, useful completion (63.0% against 19.7%). The reviewer made 930 extra model calls and did worse on both counts. The boundary spent none.
The next question to ask of every agentic stack
OBPE doesn't solve everything, but it does close the gaps in agentic governance that remain unsolved when LLMs are part of the solution, and it does so with the efficiency and determinism of classic software. A model guard is an inference call on every step, so its cost and latency scale with its capability. You cannot buy your way from probabilistic to deterministic. A policy decision is a typed evaluation against a written rule, and it gives you the same answer in microseconds with no tokens spent.
No company lets employees approve their own access requests from a document they wrote themselves. Agents shouldn't either, and CoreBreak is the argument for why that's not a philosophical position but an engineering requirement. The CVEs and the patches point in the same direction as the researchers' own hardening list: enforcement belongs at a boundary the agent cannot reach.
If you are putting agents in front of real data, the question to ask of every stack you evaluate is whether your agent is governing itself. CoreBreak is what happens when the answer is “yes.”
This story was produced by Redpanda and reviewed and distributed by Stacker.
(0) comments
Welcome to the discussion.
Log In
Keep it Clean. Please avoid obscene, vulgar, lewd, racist or sexually-oriented language.
PLEASE TURN OFF YOUR CAPS LOCK.
Don't Threaten. Threats of harming another person will not be tolerated.
Be Truthful. Don't knowingly lie about anyone or anything.
Be Nice. No racism, sexism or any sort of -ism that is degrading to another person.
Be Proactive. Use the 'Report' link on each comment to let us know of abusive posts.
Share with Us. We'd love to hear eyewitness accounts, the history behind an article.