[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-renaming-one-option-fools-ai-safety-guardrails-into-allowing-attacks":10,"sections":35},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":24,"tags":25,"sources":30,"feedback":34,"feedback_at":22,"cost_usd":34,"total_tokens":34},10918,"renaming-one-option-fools-ai-safety-guardrails-into-allowing-attacks","Renaming One Option Fools AI Safety Guardrails Into Allowing Attacks","A new study finds that simply mislabeling an option can trick AI guardrail models into approving blocked actions nearly every time.","AI guardrails that gate tool calls can be fooled with nothing more than a misleading label.\n\nResearchers tested seven open-weight typed decision models, classifiers that read text and return a probability across a short list of allowed options, the kind of component many agent systems use to approve or block a tool call. On jailbreak and prompt-injection screening, allow-or-block accuracy ranged from 36% to 72%, close to a coin flip's 50% baseline. Adding six lines of irrelevant server log text to a tool call request raised one gate's fail-open rate, meaning it wrongly allowed a blocked action, from 0% to 63%. Simply renaming the permissive option, while leaving its definition and the judged text untouched, pushed that rate to between 93% and 100% on the four models that expose option labels in their own input.\n\nThat matters because these models are already being deployed as the decision-maker in agent pipelines, not just a filter. Every defense the researchers tried failed, including escalating low-confidence calls to a human reviewer: a decision an attack flipped was no less confident than the one it replaced. The one approach that held up, parsing policy fields into typed values, also showed a plain deterministic rule over those fields reaches 100% accuracy, which makes the model unnecessary.\n\nA gate that opens because someone renamed a button isn't a security layer, it's a formality.","[\"ai-security\",\"guardrails\",\"prompt-injection\",\"llm-safety\"]","2026-10-09T04:00:00.000Z","2026-10-09T21:31:31.564Z","2026-10-09T21:31:37.925Z","published",null,[],"security",[26,27,28,29],"ai-security","guardrails","prompt-injection","llm-safety",[31],{"name":32,"url":33},"arXiv cs.AI","https:\u002F\u002Farxiv.org\u002Fabs\u002F2610.12292",0,{"sections":36},[37,41,44,49,54,58,62,67,72,77,82,87,92,97],{"name":38,"slug":39,"count":40,"latest_published_at":18},"AI","ai",6690,{"name":42,"slug":24,"count":43,"latest_published_at":18},"Security",930,{"name":45,"slug":46,"count":47,"latest_published_at":48},"Policy","policy",486,"2026-10-08T22:40:11.000Z",{"name":50,"slug":51,"count":52,"latest_published_at":53},"Deals","deals",474,"2026-10-08T22:00:00.000Z",{"name":55,"slug":56,"count":57,"latest_published_at":18},"Hardware","hardware",231,{"name":59,"slug":60,"count":61,"latest_published_at":18},"Science","science",192,{"name":63,"slug":64,"count":65,"latest_published_at":66},"Consumer Tech","consumer-tech",181,"2026-10-08T23:26:35.000Z",{"name":68,"slug":69,"count":70,"latest_published_at":71},"Startups","startups",117,"2026-10-08T16:45:00.000Z",{"name":73,"slug":74,"count":75,"latest_published_at":76},"Software","software",114,"2026-10-08T17:57:01.000Z",{"name":78,"slug":79,"count":80,"latest_published_at":81},"Dev Tools","dev-tools",105,"2026-10-07T16:59:11.000Z",{"name":83,"slug":84,"count":85,"latest_published_at":86},"General","general",66,"2026-10-09T04:46:11.000Z",{"name":88,"slug":89,"count":90,"latest_published_at":91},"Gaming","gaming",58,"2026-10-08T20:08:45.000Z",{"name":93,"slug":94,"count":95,"latest_published_at":96},"Reviews","reviews",34,"2026-10-08T14:00:22.000Z",{"name":98,"slug":99,"count":100,"latest_published_at":101},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]