We stress-tested our own AI agent guardrails before launch. Here's what broke.

You can't find the holes in a security system you designed. Your test suite maps the space you imagined, which is exactly what an attacker tries to escape. Before we opened APort Vault to the public, we spent two weeks doing exactly that — trying to break our own guardrails. Not with a test suite. With intent. We broke three of our eight core policy rules before any public player tried. TL;DR Internal stress-testing before CTF launch broke 3 of 8 core guardrail rules. Five attack classes: prompt injection, policy ambiguity, context poisoning, multi-step chaining, passport bypass. Most dangerous finding: multi-step chaining — each micro-action passes; the composition violates policy. Fixes: intent-based injection checks, default-deny for gaps, cross-turn session memory, opaque denial messages. Core lesson: post-hoc filtering fails. Make dangerous states structurally unreachable. Why are AI agent guardrails just security theater? Most AI guardrails work like airport security theater. The