A structured answer does not enforce a security rule

A model can return a strictly typed answer and still make a linguistically manipulated authorization decision. Another model can recognize an AI-directed message in a document yet fail to tell the user. These failures look different at the interface, but both arise when a security-relevant distinction must be carried through a language-processing step without losing its meaning.

In the option-channel attack study, a guard model reads a proposed action and outputs a probability over caller-defined allow-or-block options. It does not generate a free-form justification. That limited output is useful for integration, but it does not make the internal policy evaluation deterministic.

The authors tested seven open-weight models. On a synthetic tool-call suite, adding six irrelevant server-log lines moved one gate's fail-open rate from 0% to about 63% for a rule it had previously applied correctly. Relabeling the permissive option while leaving its definition and the evaluated action unchanged led to 93% to 100% fail-open rates among four models that incorporated the label. These are controlled failures, not proven bypasses of a deployed authorization service. The original paper also demonstrates why confidence alone is a poor substitute for checking the actual rule.

The point is not that a typed API is useless. It can standardize transport and validation of output structure. The mistake is to assume that the same structure independently enforces the rule being interpreted. For action authorization, the decisive allow or deny should be derived from validated policy facts, principals, resources and parameters. In a bounded set of six sample rules, deterministic evaluation performed correctly; that result is not proof for every policy language.

The hidden-message disclosure study tested simulated document tasks with plaintext and ROT13 messages addressed to another AI. It used 1,280 ordinary-note and 128 enhanced-note sessions. Explicitly instructing agents to report such material increased notifications by 53.1 percentage points for harmless encoded examples and 54.7 for harmful ones. Researchers also identified eleven ordinary plaintext cases where a model appeared to interpret the hidden material but did not notify the user. These are joint effects of inspection, recognition and notification, not measurements of an agent's deliberate concealment or of deployed-system compromise. The paper separates those outcomes.

That finding should not be read as another fail-open authorization rate. A user can be uninformed even if no forbidden tool call occurs. Conversely, a prompt-injection disclosure may be excellent while an external tool still accepts an unauthorized command. Reporting is an accountability function, not permission enforcement.

The comparison suggests two separate acceptance tests. First, change superficial labels or add irrelevant context while holding the actual authorization rule constant: the permitted action should not change. Second, plant clearly marked third-party AI-directed material in a controlled document and verify both the user's notice and the downstream action trace. Neither test makes the other redundant.

A narrow JSON envelope can make a system easier to connect; a clear final explanation can make it easier to inspect. Neither should be mistaken for proof that untrusted words failed to cross the authority boundary.