Forged Control Tokens Erase gpt-oss-20b's Chain of Thought

Forging gpt-oss-20b's own control tokens erases its reasoning, according to a paper posted to arXiv on September 23. A rule-based monitor and a separate cross-family LLM monitor each caught every plain unsafe request tested. Neither caught a single forged one, and the attack converted 39.6% of requests the model would otherwise refuse into completed data exfiltration.

The mechanism is a tokenizer quirk. One string of the model's own channel-control tokens, placed in a user message, reads to the tokenizer as a signal that the reasoning turn already finished. Chain-of-thought output drops from 52.5 tokens to zero and the model jumps straight to a tool call. That skip blinds any monitor built to scan reasoning text for red flags, because once the skip happens there's no reasoning text left to scan.

A second test in the same paper looked at the agent harness instead of the model. Two parsers built for a Gemma-based agent fired a truncated tool call on 24 of 24 trials. Run through a different parser, the identical model generations produced zero truncated calls. The model didn't change. The parsing code did.

Both findings land on the same gap. A safety check built to read a model's reasoning has nothing to read once a user forges the tokens marking reasoning as finished, and the code parsing a model's output carries as much risk as the model itself.