One word can open the security door: option channel attacks in Agent guardrails

Researchers from the University of Southern California published a paper on October 8, 2026 (arXiv 2610.12292), evaluating the reliability of 7 open-weight models as Agent safety guardrails and proposing an option channel attack against typed decision models. Experiments show that appending six lines of irrelevant logs to tool output causes about 63% of dangerous operations that were originally correctly blocked to be incorrectly allowed; under a specific implementation that only changes option names without touching the content to be checked, the incorrect-allow rate can reach 93%–100%, and Qwen2.5-7B's average incorrect-allow rate on GuardBench rises from 4.7% to 100%. Decisions flipped by the attack do not necessarily manifest as low confidence; reviewing only about 10% of requests can only reduce the incorrect-allow rate to about 54%. Defenses such as prompt instructions and structured input can still be bypassed under adaptive attacks, while deterministic rules based on parsing results achieve 100% accuracy on GuardBench; the attack premise is that the attacker can influence option names and the names enter the model input.