CoreBreak bypasses AI agent guardrails at the plumbing layer — and model-level defenses cannot help

Forkast reported on August 16 that security researchers have disclosed a new attack technique called CoreBreak that can bypass AI agent guardrails.

Unlike adversarial examples that attack the model itself, CoreBreak targets the "plumbing layer" of agents — the underlying infrastructure that connects models, tools, and data. When the attack happens at this layer, the model often has no awareness at all.

The danger is structural: guardrails are usually enforced at the model level, and when an attack occurs at a layer the model cannot perceive, model-based safety judgments simply stop working. The report states clearly that model-level defenses cannot help against CoreBreak.

Why it matters: agents are being deployed into real business workflows where they execute code, call APIs, and access enterprise data. A compromise at the plumbing layer has consequences far beyond a single conversation.

For builders, the takeaway is that agent security needs defense in depth: hardening tool-call authorization, API access control, and data-flow auditing, rather than relying solely on a model's ability to refuse.

What to watch next: whether agent frameworks and platforms issue patches or mitigations, and whether CoreBreak sees real-world exploitation.