When AI Guardrails Expose Vulnerabilities

Summary

CrowdStrike researchers describe Guardrail-based Vulnerability Discovery (GbVD), a method that treats a frontier AI model's refusal to explain code as a signal of a hidden flaw. In a small C web server, a model that had explained every other function refused one function containing a one-character logic inversion that creates an out-of-bounds write. In controlled tests across five vulnerability classes, GbVD was correct in 73 of 86 scenarios.