CrowdStrike Turns AI Refusals Into Vulnerability Findings
Global – October 31, 2026 -- CrowdStrike researchers say they located software vulnerabilities by watching where a frontier AI model refused to answer, and their method was correct in 73 of 86 controlled test scenarios across five vulnerability classes.
The approach, called Guardrail-based Vulnerability Discovery (GbVD), began when a model declined to explain one function in a small C web server. It had explained every other function in the codebase. A single token in that function had been changed from a max to a min, creating an out-of-bounds write. The prompt asked only what the code does, with no mention of security, exploits or vulnerabilities.