Global – October 31, 2026 -- CrowdStrike researchers say they located software vulnerabilities by watching where a frontier AI model refused to answer, and their method was correct in 73 of 86 controlled test scenarios across five vulnerability classes.
The approach, called Guardrail-based Vulnerability Discovery (GbVD), began when a model declined to explain one function in a small C web server. It had explained every other function in the codebase. A single token in that function had been changed from a max to a min, creating an out-of-bounds write. The prompt asked only what the code does, with no mention of security, exploits or vulnerabilities.
CrowdStrike validated GbVD on real open-source projects through its disclosure program
Beyond the lab tests, the method held up on real open-source projects, which CrowdStrike disclosed through its Coordinated Vulnerability Disclosure (CVD) program. The researchers say this kind of logic inversion slips past code review and is routinely missed by pattern-matching scanners.
Four guardrail behaviors leak information to defenders
Refusals are only one observable. CrowdStrike lists four forms a guardrail can take:
- Explicit refusals, including "reason: cyber" in standard APIs.
- Model downgrading, detectable through latency, tokens spent, time-to-first-token or a drop in output specificity.
- Output filtering and truncation, which alter response length and shape.
- Reasoning interruption, where an agentic guardrail aborts a tool call or halts a reasoning chain without refusal text.
The experiments used refusals because they are the loudest channel today, but the researchers say the methodology works with any measurable perturbation.
Bisection narrows a codebase to the triggering code
Because the guardrail signal is binary and localized, it can be combined with bisection. Analysts split a codebase or filesystem into halves, ask the model to explain each, and recurse into whichever half triggers the guardrail.
CrowdStrike argues that every guardrail improvement by AI labs also sharpens this technique for both practitioners and adversaries. The work builds on its earlier research into bypassing LLM safety classifiers.