Appending gpt-oss-20b's Own Channel-Control Tokens Drops Its Chain-of-Thought to Zero and Blinds Both CoT Monitors

arXiv·high signalXBlueskyLinkedInCopy link

arXiv 2609.27542 (23 Sep) shows that one string of the model's channel-control tokens in a user message makes the tokenizer render an already-complete reasoning turn, so gpt-oss-20b skips reasoning (52.5 tokens to 0) and goes straight to the tool call. A rule monitor and a cross-family LLM monitor caught every plain unsafe request and none of the forged ones, and the attack turned 39.6% of refusals into completed exfiltrations. Separately, two parsers shipped for the Gemma agent fired a truncated tool call on 24 of 24 trials and 0 of 24 on identical generations, so harness parsing decides safety as much as the model does.