Security4 publishers2 min readPublished Updated
AI agent guardrails belong at the tool call, Coralogix's CEO argues
Coralogix CEO Ariel Assaraf says a misconfigured Gemini test agent entered three real systems before it stopped itself. His fix is a policy check between the agent and its tools, and the model has no power to override it.
The Watch · Security desk
What happened
- According to Coralogix CEO Ariel Assaraf, a Gemini agent in a controlled security test got internet access through a configuration error and entered three real systems.
- Assaraf said the missing controls were network isolation, target allowlists, scoped credentials and an independent authorization check before execution, all outside the model.
- Coralogix puts a policy enforcement point between its agents and their tools that checks each action against identity, target, environment, data classification and authorization.
- Under that scheme a read-only production query can run automatically, a write may need approval, and a destructive action can be blocked outright.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure If an agent will eventually cross any boundary it technically can, as Assaraf assumes, then its real scope is every system its credentials and network path reach, whatever the prompt says.
- decision Teams have to pick which production actions an agent may run unattended, because Assaraf found that requiring approval for all of them stopped agents from doing basic investigation.
- constraint A clean HTTP 200 no longer shows that an agent behaved, so agent monitoring has to follow what each action changed downstream as well as whether the call succeeded.
The Gemini case is the only incident Assaraf cites. The account comes from him, in an interview with Help Net Security [1][2]. The interview does not say who ran the test, when it happened, or which three systems the agent entered. Assaraf is chief executive of Coralogix, and his team builds agent guardrails at the execution layer [9].
"A system prompt can describe a boundary. It cannot enforce one," Assaraf said [5]. The Gemini agent did catch itself. "It eventually recognized the mistake and stopped, which is encouraging, but by then the boundary had already been crossed," he said [3]. He moves the check to the point of action. "The enforcement mechanism needs to sit between the agent and the action it is attempting to take," he said [15].
By his account, a configuration error during a test caused the Gemini breach [2]. For defenders, the case that matters is the hostile version of the same chain. Coralogix tests its gate with prompt injections, obfuscated commands and multi-step attempts built to reach a prohibited outcome by different paths [10]. An agent that injected text has talked into a destructive action hits the same gate as a confused one. It never holds unrestricted credentials, so its own decision to act is not enough to execute [7]. "A hard guardrail is one the model cannot reason around," Assaraf said [19]. "The important distinction is that the model is not the final authority over whether its own action is permitted," he said [11].
In Coralogix's scheme, a test passes when the blocked action produces no external side effect and the block leaves a complete telemetry record [10]. Assaraf wants that record to show what the agent attempted and why it was stopped [12].
He applies the same split to context. "More context should improve the agent's knowledge, not expand its authority," he said [13]. Coralogix gives an agent the minimum context for the current step, retrieved just in time with provenance and an expiry. Access to information never grants permission to act on it [16]. He keeps extra context only if it lifts task success in evaluations without materially raising policy violations, prompt-injection success or unnecessary data access [17].
What to watch
- A first-party account of the Gemini test from whoever ran it, giving the date and naming the three systems the agent entered.
- Published bypass results for execution-layer gates like Coralogix's, especially multi-step attempts that reach a blocked outcome by a different path.