CrowdStrike: a model's refusal to explain code points at the bug

01What happened

Jonathan Bar Or and D'Angelo Gonzalez of CrowdStrike published Guardrail-based Vulnerability Discovery, or GbVD, on October 28, 2026. They asked a frontier model to explain each function in a small C codebase. The model explained every function except one, which it declined to explain after a one-token change turned a max into a min and created an out-of-bounds write.

02How it works

GbVD reads guardrail activations as diagnostic output rather than as dead ends. A harness repeats each prompt and counts a refusal only when at least three of five runs refuse, which absorbs the model's nondeterminism. A clean-code baseline run first filters out refusals that fire on safe code, and bisection then narrows the trigger down to the smallest unit of code. The authors also count model downgrading, output filtering and interrupted reasoning as usable signals.

03Who is affected

The case studies cover two kinds of defect: a memory-safety bug in C, shown on the open-source project tinyhttp, and a privilege escalation misconfiguration, shown on a planted SUID-root binary in a filesystem tree. CrowdStrike does not name the frontier model it tested, and cautions that guardrail behavior will change as models are updated.

04What to do

Treat refusals, latency spikes, token count changes and aborted tool calls as findings, and build harnesses that record them instead of only the answer text. Run a clean baseline before trusting any refusal, and expect attackers to read the same signal. CrowdStrike says findings in real open-source projects went through its coordinated vulnerability disclosure program.

Sources 3 links, all fetched

1. 1crowdstrike.comCrowdStrike Research
2. 2crowdstrike.comLLM Classifier Bypasses
3. 3github.comtinyhttp Repository