One Word Opens the Gate: The Option-Channel Attack on Typed Decision Models as Agent Guardrails
Renaming one label in a guardrail's input pushed its failure-to-block rate from 0% to as high as 100%.
Researchers tested seven open-weight 'typed decision' models used as guardrails to approve or block agent tool calls and messages, and found baseline accuracy as low as 36% (worse than a coin flip). Attacks as simple as adding irrelevant log text or renaming a permissive option's label pushed fail-open rates (letting through prohibited actions) up to 100% on vulnerable models, and every tested defense was broken.
Why it matters
Many agent frameworks use a lightweight classifier model as the safety gate deciding whether a tool call or message is allowed, treating it as a cheap, reliable filter. This research shows that gate can be flipped with trivial, non-semantic manipulation of its input text, and that known mitigations (confidence thresholds, escalation) don't help, undermining a pattern that's become common in agent safety architecture.
What is verified
The researchers evaluated seven open-weight models used as guardrails that decide whether to allow a proposed tool call or message, and found allow-or-block accuracy on prompt-injection, jailbreak and toxic-content tasks ranged from 36% to 72% against a 50% chance baseline. [1]
Adding six lines of server log text unrelated to the policy raised a guardrail's fail-open rate (allowing a prohibited action) from 0% to 63% on a policy it otherwise decided correctly. [1]
Simply renaming the permissive option to a misleading label, while leaving its definition and the judged text unchanged, raised the fail-open rate to between 93% and 100% on the four models that expose that label in their input. [1]
Every defense the researchers tested against these attacks was defeated, either by an attacker targeting the defense mechanism directly or by attacker-controlled text. [1]
Parsing each policy field into a typed value eliminated one of the attacks, but a deterministic rule over those same typed values reached 100% accuracy on all six policies, making the model component unnecessary in that configuration. [1]
What is not
- The paper is a preprint (submitted Oct 2026) and has not undergone peer review or independent replication.
- It is unclear which seven specific open-weight models were tested, beyond the aggregate accuracy range given.
- The synthetic suite of agent tool calls and six specific policies used are not described in detail in the supplied abstract; real-world guardrail deployments may differ in configuration.
- No information on whether commercial/closed-weight guardrail models (e.g., those used by major agent frameworks) show the same vulnerability.
Sources
- 1arXiv cs.CRarxiv.org · Primary source
Original source published 8 October 2026 at 18:46.
An AI-assisted briefing by Coding Partners. We link the evidence behind the reporting so you can explore the original work and assess the claims. How CP Signal works.