CoreBreak bug let attackers bypass guardrails in 3 agent platforms
An attacker can make an agent operate a tool with no model check. All 3 vendors made patches.
At Black Hat 2026, 2 researchers showed a bug, CoreBreak, in 3 large agent platforms. An attacker can make an agent operate a tool with no check by the model or its guardrails. The 3 vendors made patches for the bugs. The score is 9.3 of 10 at most, on a scale for how bad a bug is.
How it works
The 3 platforms are:
Guardrails are around the model. An attack that bypasses the model bypasses all of them. Researchers Aviyam Ivgi and Hedi Ingber showed 2 attacks.
- The attacker sends a message history. Its last message is a tool command, and the tool operates with arguments from the attacker.
- The attacker makes an incorrect “approved” signal. The human step then accepts a task that no human saw.
The numbers
Redpanda, a firm for AI infrastructure, made 3,621 trials on 4 models. Agents with only rules in the system prompts were not safe in 57.6% of trials. Behind an external boundary, they were not safe in 0.2%.
What is not known
The tests are by Redpanda. No other group did a check of them. The source gives no test results for the patches. Redpanda says its method is not a full solution.
Insight: Control in the agent is open to attack
On 11 October, 2 AWS engineers say that hooks, code in the agent loop, stop a defective agent. On 12 October, researchers made 6 frameworks operate a tool command from an attacker. Input can touch control in the agent but not external control, so the vendor with the external boundary maybe gets more control. Until a test shows differently, an in-agent control is possibly open to attack.
Sources
Posted
