Control-Token Injection Suppresses Chain-of-Thought and Defeats Reasoning-Based Oversight in Tool-Using Agents
Researchers show that injecting special tokens into the chat-template layer — outside the model itself — can silently disable chain-of-thought safety checks in tool-using agents, reframing agent security as an infrastructure problem.
Summary written by editorial AI · Source link below
arXiv:2609.27542v1 Announce Type: new Abstract: The safety of a tool-using language model agent is usually treated as a property of the model alone. We give controlled, full-precision evidence that it is instead a joint property of the model and the software that renders its chat template and parses its tool calls, the decoding harness, and that both halves are attackable from untrusted input. On the released gpt-oss-20b reasoning model under its published tool sandbox, appending a single strin
Editorial Analysis
Enterprises deploying agentic AI must treat the rendering and parsing stack as part of the trust boundary, not just the model weights — a gap most current procurement checklists miss.
Include chat-template and tool-parsing infrastructure in threat models and penetration tests for any deployed LLM agent system.
AI agent safety is not just a model problem — the surrounding software stack can silently disable safety guardrails, requiring infrastructure-level assurance.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at arXiv Crypto & Security in a new tab.
More from the AI Security Desk
- OpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox Communication1d
- Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions3d
- You gave your AI agent access, but who is giving it orders?3d
- AI Agents as Insider Threats: Inside Microsoft's Bet on a Unified Security Stack3d
- Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances3d