A guardrail that decides at the door lets the intruder walk in later
I report security bugs in AI-agent guardrails, and I keep finding the same shape of bug. This is the first one that's fully public, so I can show you the whole thing — the finding, the fix that shipped, and why I think the design itself is the problem. The finding (airlock, now public) airlock is a prompt-injection guardrail in the Hermes plugin catalog. Its job is to stop an agent from doing…
A security researcher has discovered a flaw in AI-agent guardrails, causing dangerous actions to bypass security measures. These guardrails, designed to prevent harmful actions without human approval, are functioning incorrectly. The researcher, Cleiton Augusto Correa Bezerra, explains how these guardrails operate based on signals that determine if an action is allowed or blocked.
However, the issue lies in the gap between the signal and the action's execution. When the signal indicates an attended state, the action is allowed to run despite being dangerous. This design, known as "stringly-typed guardrails," consistently fails, allowing actions to proceed unchecked. The researcher proposes an alternative solution called CleiMesh, which changes the guardrails' approach.
Instead of making decisions at the door (checking signals), CleiMesh makes the permission the sandbox. Agents run under signed, delegable tokens with explicit access rights, ensuring they never have more permissions than granted. This prevents the same failure mode where a dangerous action can bypass security measures. The researcher emphasizes the importance of addressing these design flaws in agent guardrails, especially when dealing with real data.
The CleiMesh project, a free and open-source solution, is available on GitHub and includes tools to set it up for various agent environments.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
