AI Refusals Can Point to Hidden Software Flaws, CrowdStrike Research Finds

CrowdStrike researchers asked a leading AI model to explain functions in a small C web server. It explained every function without hesitation except one. The only change in that function was a single token, a max swapped for a min, which created an out-of-bounds write. This is the kind of bug that can slip past code review and be missed by scanners that rely on pattern matching. The model never said the code was vulnerable, but its refusal showed researchers exactly where to look.

The team argues that AI safety guardrails must first recognise something as dangerous before they can block it, and that recognition is a signal people can read. CrowdStrike calls its approach Guardrail-based Vulnerability Discovery (GbVD). In controlled tests across five vulnerability classes, it was correct in 73 of 86 scenarios. It also held up on real open-source projects, which the company disclosed through its Coordinated Vulnerability Disclosure program.

The researchers say this challenges the idea that safety and capability are a trade-off, because better guardrails also sharpen this technique for both defenders and adversaries. Refusals are only one visible sign: CrowdStrike notes that guardrails in deployed AI systems take many forms, and most of them leak information. This summary covers only the opening of the research.