CrowdStrike finds code bugs where an AI model refuses to answer

CrowdStrike researchers asked a frontier AI model to tell what one function in a small C web server does. The model told what all other functions do, but it refused this one. One character was different: a max was a min, and this caused a write outside the memory limit. In tests on five classes of bug, the method was correct in 73 of 86 scenarios.

How it works

A guardrail is a safety limit that makes a model refuse risky help. To refuse, the model must first find the risk. The team reads the refusal as a signal. They divide the code in two halves and ask the model about each half. They go on in the half that causes a refusal. Other signs also leak, such as slow answers or a switch to a smaller model.

The numbers

In tests on five classes of bug, the method was correct in 73 of 86 scenarios. CrowdStrike tells that it also worked on open source projects that it reported through its disclosure program. The source gives no results for those projects.

What is not known

The tests used refusals, which are the loudest signal at this time. CrowdStrike tells that an attacker can use the same method. The source does not tell how frequently the model refuses when the code has no bug.

Insight: A working safety limit also shows where the risk is

In October 2026, a paper reported that its BRANCH method bypassed 6 guardrail systems in all 120 tests. Now CrowdStrike shows that a guardrail that works also tells where the bug is. Guardrails are attacked from two sides, and more safety may give attackers and defenders more to read. Maybe labs will next hide the signal. A refusal is data that can leak.