Weaponising Model Safety: Steering LLM Decision Harnesses

LLM-based decision agents (phishing triage, SOC alert triage, content moderation, CI security gates, transaction screening) send untrusted input to a model, ask for a classification, and branch on the answer. Providers now enforce safety policy with hard stops: generation is terminated and the caller receives a refusal rather than a verdict. We show that this refusal is an attacker-reachable control-flow input. When an attacker places content in front of the classifier that trips the provider's safety layer, the call returns no verdict, and many harnesses map that absence to their permissive default: deliver, approve, close. The attacker does not fool the model; they stop it from answering. We test 14 common handling patterns. All 14 classify a malicious item correctly when given a clean verdict, and 12 of them then fail open on at least one non-verdict state; 73% of outcomes across all patterns and non-verdict states are fail-open. A live probe confirms that the stop happens before any output is produced, that structured output is not exempt, and that the harness reports the refusal in an envelope marked subtype: "success". The fix is a few lines of code. The mechanism is old, the trigger is newer than the code it breaks, and, unlike prompt injection, it becomes more reliable as models get safer.