Guardrail bypass
Also called: guardrail evasion · filter bypass
A guardrail bypass is a technique that gets past a safety layer placed around an AI model, such as an input filter, output classifier, prompt-injection detector or policy engine, so that blocked content or actions go through. It targets the wrapper, not the model's own training.
How it works
Bypasses exploit gaps between what the guardrail checks and what the model understands: encodings, other languages, split payloads, unusual formatting, or content the guardrail never sees, such as tool results. Classifier-based guardrails can also be fooled by adversarial inputs tuned against them.
How to defend
Layer controls instead of trusting one filter, check both inputs and outputs, and test guardrails with adversarial suites. Enforce hard limits (permissions, sandboxes, approvals) outside the model wherever possible.
Real cases 3 stories
MED
Research · arXiv
BRANCH: a tree search bypassed six AI guardrail systemsBRANCH is an attack from Mindgard that rewrites a blocked prompt step by step until every detector in a multi-scanner guardrail passes it. The authors report a 100% attack success rate against six guardrail systems across 120 scenarios.
MED
Attack · CrowdStrike
Request, Aggregate, Bypass: benign subtasks defeat a safety classifierSplitting an offensive goal into benign subtasks let CrowdStrike's lab pull exploit knowledge out of a classifier-guarded frontier model, then have a smaller unguarded model assemble working code in 9 of 10 attack categories.
INFO
Research · NCC Group
NCC Group: subagents did not inherit the parent agent's guardrailsNCC Group reports that in agent stacks built on the Claude Agent SDK, requests the main agent refused succeeded once delegated to a subagent, and that an agent could rewrite its own hooks and settings to persist.