Prompt trick zeroes out gpt-oss-20b's reasoning tokens

A forged channel-control token drops gpt-oss-20b's reasoning step from 52.5 tokens to zero, per the paper on gpt-oss-20b's channel-control exploit.

That matters because reasoning is where these models catch bad requests. Skip it, and 39.6% of what should be refusals become completed exfiltrations.

A rule-based monitor and a cross-family LLM monitor both caught every plain unsafe request. Neither caught a single forged one. The forgery doesn't fool the model's judgment. It routes around the step where judgment happens instead.

Two parsers built for the same Gemma agent got opposite results from identical output. Researchers ran both against the same 24 generations. One parser fired a truncated tool call on all 24 trials. The other fired on zero. Same inputs, same model output, opposite behavior, because the parsing layer decided differently what counted as a complete call.

An agent harness with a tool-call parser between model output and execution has a second decision-maker in the loop. That parser hasn't been audited against adversarial input the way the model has. The paper doesn't say whether other parser pairs show the same 24-0 split, or whether this is specific to how these two handled truncation. That gap matters before anyone assumes their parser is neutral.