A preprint posted on Oct. 8 reports that appending six routine server-log lines to an agent tool-call trace pushed one model’s fail-open rate from 0% to 63% in a synthetic security test. The rate counted only prohibited actions the model had correctly blocked before the text was added; it is not a measurement of deployed agents.
A typed decision model is a classifier that returns probabilities for fixed choices, such as “allow” and “block,” instead of writing an explanation. Developers can put one between an AI agent and its tools to screen proposed actions against a policy. A fail-open error lets a prohibited action through; a fail-closed error blocks an allowed one.
Researchers at the University of Southern California tested seven open-weight models on balanced public datasets for prompt-injection, jailbreak and toxic-content screening. Accuracy ranged from 36% to 72%, against 50% for chance. The error direction mattered: some models tended to allow almost everything, while another blocked nearly everything.
The team then created GuardBench, a synthetic set of agent tool calls governed by six security policies. Each call included structured details such as its destination, whether it contained credentials, whether it could be undone and whether a user had approved it. For one policy, which blocks unapproved actions that cannot be undone, the laya-td model correctly blocked 150 test cases before any attack. Adding six ordinary log lines raised the share of those correct blocks that turned into allows to 63%.
A second test changed the name attached to the permissive option while keeping its definition and proposed action unchanged. The model still scored the same fixed choices; because the caller maps that option to allow, a label that nudged the model toward it could let the prohibited action through. After testing label variants, the researchers found that the most effective names raised fail-open rates to 93%–100% for four of six models that included option names in their input. The other two models did not receive those names and were unaffected. This attack assumes someone can influence the label supplied through the caller configuration or schema; it does not rely only on text returned by a tool.
A deterministic rule using the same structured policy fields reached 100% accuracy across GuardBench’s six generated policies. Because the rules and test calls were generated together from known attributes, that result applies to this suite, not to policies the researchers did not test. The authors say a model may help sort cases for human review, but should not make the final security decision on this evidence.
Sources
- Azizi, Potraghloo and Pedram, “One Word Opens the Gate” (arXiv:2610.12292v1, posted Oct. 8, 2026). The paper and Figure 1 are licensed CC BY 4.0.
- Authors’ code repository.