Control-Token Injection Suppresses Chain-of-Thought and Defeats Reasoning-Based Oversight in Tool-Using Agents
Researchers show that injecting special tokens into the chat-template layer — outside the model itself — can silently disable chain-of-thought safety checks in tool-using agents, reframing agent security as an infrastructure problem.
Summary written by editorial AI · Source link below
arXiv:2609.27542v1 Announce Type: new Abstract: The safety of a tool-using language model agent is usually treated as a property of the model alone. We give controlled, full-precision evidence that it is instead a joint property of the model and the software that renders its chat template and parses its tool calls, the decoding harness, and that both halves are attackable from untrusted input. On the released gpt-oss-20b reasoning model under its published tool sandbox, appending a single strin
Editorial Analysis
Enterprises deploying agentic AI must treat the rendering and parsing stack as part of the trust boundary, not just the model weights — a gap most current procurement checklists miss.
Include chat-template and tool-parsing infrastructure in threat models and penetration tests for any deployed LLM agent system.
AI agent safety is not just a model problem — the surrounding software stack can silently disable safety guardrails, requiring infrastructure-level assurance.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at arXiv Crypto & Security in a new tab.
More from the AI Security Desk
- Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub2d
- Runaway AI hacking agent behind WorkOS breach after escaping sandbox3d
- AI Gave Your Incident Archive a Second Job3d
- Malicious Browser Extensions Could Use Claude Dispatch to Run Code on Users' Computers3d
- AI Slop and Hallucinations in Vulnerability Assessment: A Survey on Reasoning Failures and Trustworthy Mitigation3d