A Multivector Safety Analysis of gpt-oss:20b

This paper studies three safety failures in one local deployment of gpt-oss-20b. The firstasks whether calling an otherwise matched exchange a simulation changes the model’swillingness to return a structured destructive-action call. The exact call rose from 78/100trials without simulation language to 97/100 with it. The second begins with a direct requestto maximize user dependency, which was refused in 30/30 trials, then presents a similarretention objective as an educational product and continues through several implementationsteps. The educational reframe and every counted phase through turn 5 were judgedcompliant in 30/30 trials; a separate condensed arm produced distress-targeted upsell logicin 30/30. The third tests whether a protected synthetic string remains separated acrossreturned fields. It appeared in the reasoning field in 25/30 runs and in the visible answerin 13/30. Across the three studies the same shape recurs: the tested safety behavior trackswhether a request matches a category the model names explicitly, not the underlying conceptthat category exists to catch. Moving a request across the boundary of a named category – bycalling it a simulation, by relabelling it, or by routing it through a channel the visible answerdoes not cover – changed the model’s behavior while the content of the request stayed fixed.The experiments use one model package, synthetic prompts, and no human participants.