CLAIM-2026-08-01-07

Of the attacks IssueTrojanBench found to be refused, 82.9% were blocked because the model explicitly recognised and rejected the malicious instruction and 17.1% because the model classified the instruction's source as untrusted metadata. The paper reports that agent-level defences based on instruction-data separation offer little additional protection.

Why it matters

This is the load-bearing engineering claim. If essentially all refusal originates in the model, then the security property a team depends on is a vendor property it did not build and cannot audit. The only layer left under the team's own control is containment of what the agent can reach.

Sources

arxiv2026issuetroj

CLAIM-2026-08-01-07

Of the attacks IssueTrojanBench found to be refused, 82.9% were blocked because the model explicitly recognised and rejected the malicious instruction and 17.1% because the model classified the instruction's source as untrusted metadata. The paper reports that agent-level defences based on instruction-data separation offer little additional protection.

Why it matters

Sources

arxiv2026issuetroj