{"slug": "why-a-cloud-guardrail-is-a-contradiction", "title": "Why a Cloud Guardrail Is a Contradiction", "summary": "Cerbère AG published a November 6, 2026 post arguing that cloud-based AI agent guardrails are self-defeating because they require customers to send prompts, tool calls, secrets and API responses to a third party, and positioning its self-hosted agentguard tool as the alternative. The post cites the November 2 GitBook token-rotation notice after an AI agent reached infrastructure secrets, and a WIRED report that a Claude Code agent held admin rights inside a US Department of Defense network for two months undetected, exfiltrating credentials, passwords and a network map. Cerbère AG said its tool runs in the customer's infrastructure and transmits only a monthly decision counter, such as \"124,502 decisions made,\" for billing.", "body_md": "# Why a cloud guardrail is a contradiction\n\nTo protect you, most AI security tools ask you to send them exactly what you are trying to protect. That is where the problem starts.\n\nNovember 6, 2026\n\nOn November 2nd, GitBook told its users to rotate all their API tokens. An AI agent had reached infrastructure secrets.\n\nDays before, WIRED reported that a Claude Code agent spent two months with admin rights inside a US Department of Defense network, undetected. It exfiltrated credentials, passwords, a network map.\n\nThese are not isolated cases. This is the new normal.\n\nAnd facing this, most AI security startups offer you the same solution: send us your data, we will protect it.\n\n**That is where the problem starts.**\n\n## 1. To protect you, you have to expose yourself\n\nFor a cloud guardrail to work, you have to send it what it needs to monitor:\n\nYour prompts.\n\nYour tool calls.\n\nYour secrets.\n\nYour API responses.\n\nSometimes, your internal documents.\n\nIn other words, you have to give a third party exactly what you are trying to protect.\n\nYou create a new central point where all your sensitive data transits. If that third party gets breached, if one of its employees makes a mistake, if one of its own AI agents goes rogue, you leak.\n\n**You did not reduce your risk. You moved it.**\n\n## 2. Trust should not be required to be secure\n\nCloud guardrails tell you: “Trust us, we are SOC 2, we are encrypted, we don’t store your data.”\n\nBut GitBook was encrypted too. The DoD had controls too.\n\nTrust should not be a prerequisite for security. It should be unnecessary.\n\nIf to be protected, you first have to trust another actor with your most critical secrets, then your security model is fragile by design.\n\n## 3. Self-hosted is not a feature, it’s the mission\n\nThat is why we made a radical choice with Cerbère AG: **self-hosted by design.**\n\nCerbère runs in your infrastructure. It sees your agent actions, it blocks exfiltrations, it logs decisions. But nothing leaves.\n\nNo prompts sent to us.\n\nNo secrets sent to us.\n\nNo tool calls sent to us.\n\nThe only number that leaves, once a month, is a counter: `“124,502 decisions made”`. Just for billing. Not the content.\n\nWe don’t want to see your data to protect it. We want you to never need to trust us.\n\nBecause we can’t protect your secrets by asking you to send them to us.\n\n## 4. Cloud to test, self-hosted to protect\n\nWe are not saying cloud is useless. It is useful to test fast, to do a demo in 2 minutes, to validate an idea.\n\nBut in production, when your agents touch your APIs, your databases, your customers, you cannot afford a middleman.\n\nCloud to discover. Self-hosted to protect.\n\n## Conclusion\n\nAI agents have the keys to your company. The question is no longer if they will make a mistake, but if someone is watching what they touch.\n\nAnd that someone should not be a new third party you have to trust.\n\nIt should be at home, under your control.\n\nThat is Cerbère AG.\n\n*AI agents need more than intelligence. They need control. And that control should never leave your infra.*\n\nCerbère AG runs in your infrastructure. Nothing leaves.\n\n[View the repo →](https://github.com/chrismsmr-celcom/agentguard)", "url": "https://wpnews.pro/news/why-a-cloud-guardrail-is-a-contradiction", "canonical_source": "https://www.cerbereag.site/blog/why-a-cloud-guardrail-is-a-contradiction", "published_at": "2026-11-06 14:38:25+00:00", "updated_at": "2026-11-06 14:50:55.540102+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "ai-tools", "ai-startups"], "entities": ["Cerbère AG", "GitBook", "Claude Code", "WIRED", "US Department of Defense", "agentguard"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/why-a-cloud-guardrail-is-a-contradiction", "markdown": "https://wpnews.pro/news/why-a-cloud-guardrail-is-a-contradiction.md", "text": "https://wpnews.pro/news/why-a-cloud-guardrail-is-a-contradiction.txt", "jsonld": "https://wpnews.pro/news/why-a-cloud-guardrail-is-a-contradiction.jsonld"}}