A typed decision model can return a clean probability over allowed options without generating free text, yet still be manipulated through the natural-language labels defining those options. Researchers evaluated seven open-weight models as agent allow-or-block guards. Across prompt-injection, jailbreak and toxicity screening, tested accuracy ranged from 36%…
Inspect the ClaimsCase · DiggingBeagle record
Option labels can make typed AI decision gates fail open
A typed agent gate remained vulnerable to misleading option names and irrelevant log text in laboratory authorization tests. The work distinguishes dangerous fail-open decisions from harmless fail-closed cost. Deterministic checking over parsed policy fields beat the tested models on six bounded rules.
Scope
Controlled finding or reported disclosure as of 2026-10-08; Lab simulation, not real unauthorized action; different from separate punctuation/JSON judge paper.
Assessment profile
Assessment method- Setting
- simulation
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
Desk review of scoped canonical Claims, the pinned SRC-2026-CP3-OPTION-CHANNEL-DECISION Source, and the publicly accessible primary disclosure. The classification applies to the documented setting and prerequisites only. Impact remains unbanded because real victim consequences are not established, and no independent reproduction is claimed. Details: The measured option-label failures have not been established in real production MCP or tool-authorization gateways.
Assessed Oct 13, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP3-OPTION-CHANNEL-DECISION-1 · CLM-CP3-OPTION-CHANNEL-DECISION-2 · CLM-CP3-OPTION-CHANNEL-DECISION-3 · Option-label manipulation defeats typed decision model authorization gates
At a glance
Structured model output is not equivalent to deterministic authorization when its labels and context are linguistic inputs. Keep final allow/deny decisions in policy code; use models for prioritization or explanation rather than the last permission gate.
Read the implicationsThe measured option-label failures have not been established in real production MCP or tool-authorization gateways. Reliability under varied policies and genuinely unseen attack distributions is unmeasured.
Limits and uncertaintyFull account
A typed decision model can return a clean probability over allowed options without generating free text, yet still be manipulated through the natural-language labels defining those options. Researchers evaluated seven open-weight models as agent allow-or-block guards. Across prompt-injection, jailbreak and toxicity screening, tested accuracy ranged from 36% to 72%, and the direction of errors often reflected a permissive or restrictive default rather than reliable policy reasoning.
In a synthetic tool-authorization suite, six unrelated server log lines raised one model's fail-open rate from 0% to 63%. Renaming the permissive option misleadingly, without changing the actual rule or tool-call text, drove fail-open rates to 93% to 100% among four affected model configurations. Parsing all policy fields into typed values and checking six sample rules deterministically yielded 100% in that bounded set. These are controlled lab results, not proof that a named deployed gateway was bypassed.
Mechanism and trust boundary
- 01
Policy definition
An agent gate receives a proposed action alongside language descriptions for allow and block options.
Boundary: An agent gate receives a proposed action alongside language descriptions for allow and block options.
- 02
Lower-trust label/context
Attacker-controlled or irrelevant text changes the model's probability assignment without changing the actual authorized rule.
Boundary: Attacker-controlled or irrelevant text changes the model's probability assignment without changing the actual authorized rule.
- 03
Authorization boundary
A resulting fail-open decision would permit an otherwise forbidden action if an external deterministic authorization check does not intervene.
Boundary: A resulting fail-open decision would permit an otherwise forbidden action if an external deterministic authorization check does not intervene.
Timeline
- Oct 8, 2026disclosure
Public disclosure
Claims & evidence
CLM-CP3-OPTION-CHANNEL-DECISION-1On the evaluated four models that ingest an option label, a misleading permissive label raised fail-open behavior to 93% to 100% while policy definitions stayed unchanged.supported
Basis: reported finding
- supportsOption-label manipulation defeats typed decision model authorization gatesprimary disclosure
Abstract, misleading option-label experiment
CLM-CP3-OPTION-CHANNEL-DECISION-2Six irrelevant lines of server log text raised fail-open behavior from 0% to 63% in one tested policy; deterministic checks over parsed policy fields reached 100% on the six bounded policies.supported
Basis: reported finding
- supportsOption-label manipulation defeats typed decision model authorization gatesprimary disclosure
Abstract, server log injection and typed-rule evaluation
CLM-CP3-OPTION-CHANNEL-DECISION-3The authors evaluated seven open-weight decision models and found allow-or-block accuracy of 36% to 72% on selected content screening tasks, illustrating sensitivity to default choice.supported
Basis: reported finding
- supportsOption-label manipulation defeats typed decision model authorization gatesprimary disclosure
Abstract, seven-model evaluation
Implications
Structured model output is not equivalent to deterministic authorization when its labels and context are linguistic inputs. Keep final allow/deny decisions in policy code; use models for prioritization or explanation rather than the last permission gate.
Controls and mitigations
- Parse enforceable policy fields into typed values and evaluate access rules deterministically.
- Treat caller-controlled option labels and tool logs as untrusted, not policy authority.
- Track fail-open separately from fail-closed errors and test label-swaps rather than relying only on aggregate accuracy.
Unknowns and contradictions
- The measured option-label failures have not been established in real production MCP or tool-authorization gateways.
- Reliability under varied policies and genuinely unseen attack distributions is unmeasured.
Sources and citation
Material revision history
- Oct 13, 2026 · Published version · first publication · revision 137