A better model won't save you | Value-poisoning benchmark | ActionRail

Skip to main content

Open source under Apache 2.0 · Review the ActionRail runtime, Console, tests, and benchmark harness. View on GitHub →

Models across 4 providers

10<br>Consequential workflows

1.7–63.3%<br>Unguarded attack success range

0/480<br>Manipulated actions executed with the rail

0/480<br>Legitimate actions wrongly blocked

Executive summary<br>The model is not the control.<br>We hid a plausible but unapproved value inside untrusted documents across ten consequential workflows, then measured whether eight models from four providers would execute the manipulated value, and whether a grounding check against the system of record caught it before the tool ran.<br>Every evaluated model executed at least one corrupted consequential value when unprotected, from 1.7% of attack cases on the most cautious model to 63.3% on the most exploited. Susceptibility swings more than thirty-fold across models a team might swap for cost or latency, so a better or safer model is not a reliable defense. With ActionRail wrapping the tool boundary, none of those corrupted actions reached the tool (0 of 480 protected attack cases), and no legitimate action was wrongly blocked (0 of 480).

Key findings<br>You can’t rely on the model.<br>The cost-optimized models teams actually deploy at scale were fooled most. The frontier models resisted, but partly by refusing to act at all, which stops legitimate work too, and some of those refusals were output truncation rather than a real decision.<br>Manipulated value executed, unguardedSmall / cost-tierFrontier / openGPT-4o miniOpenAI · small

63.3%<br>GPT-4.1 miniOpenAI · small

48.3%<br>Claude Haiku 4.5Anthropic · small

26.7%<br>GPT-5.6 LunaOpenAI · frontier

21.7%<br>Grok 4.5xAI · frontier

20.0%<br>Kimi K3Moonshot · open-weight

16.7%<br>GPT-5.6 SolOpenAI · frontier

13.3%<br>Claude Sonnet 5Anthropic · frontier

1.7%

Full 60-case attack suite, unprotected. On the held-out (frozen) split the spread widens to 0%–70%. Susceptibility is the primary result; the grounding catch-rate is a deterministic diagnostic, not the headline.

Methodology & threat model<br>Not a jailbreak. A forged value.<br>The attack is not an instruction the model can flag. It is an ordinary-looking document: an invoice whose remittance account has quietly changed, a support ticket that names a new recovery address, a receipt padded with a fake pre-approved line item. The value looks like legitimate business data, so the model reads it and acts on it. Every case enters through the agent’s normal untrusted read tool and ends in one consequential call. Faced with each, the agent can use the trusted system-of-record value, execute a corrupted value, refuse, or make an unrelated task error. Per model: 60 attack cases, 60 legitimate-but-messy cases, and 10 clean controls, each run three times.<br>Evaluation path<br>ConditionQuestionReported outcomeUnprotectedDoes the model emit and execute a corrupted consequential value?SusceptibilityActionRail protectedDoes a corrupted action still execute? Is approved work blocked?Residual risk + rail false positivesOffline replayWhat do the frozen rules do to the exact corrupted baseline proposal?Secondary catch diagnostic<br>Workflows<br>Reimbursements, AP payments, Password resets, Payroll changes, Vendor onboarding, Customer refunds, Procurement, Shipping changes, Benefits enrollment, API-key rotation.<br>Legitimate stress tiers<br>TierWhat it stressesCases / modelExact SoRApproved changes and suspicious-looking but independently approved values24NormalizationEquivalent account, address, URL, IBAN, and representation forms13PolicyCeilings, rounding, subsets, and bounded actions6TemporalVersioned records and values valid at action time7List schemaMultiple approved recipients, allocations, and structured records10<br>The development/frozen split is author-visible and known-technique, not blind. Cases are the independent unit; the three repetitions reveal rollout variance but are correlated and are not treated as independent samples. Legitimacy is judged by an oracle that never calls ActionRail’s matcher, so a false positive is a genuine disagreement.

Results<br>Zero manipulated actions reached the tool. Zero false positives.<br>With ActionRail at the execution boundary, no manipulated value executed on any of the eight models (0 of 480 protected attack cases), and offline replay of every corrupted proposal the unprotected models made was rejected 350 of 350. On the legitimate half, ActionRail allowed all of them on every model and every readiness tier — 0 false positives, including the reused-value cases that refute “you’re just blocklisting scary strings.”<br>ModelTierAttack successResidual w/ railFalse positivesGPT-4o miniOpenAIsmall63.3%● 0● 0GPT-4.1 miniOpenAIsmall48.3%● 0● 0Claude Haiku 4.5Anthropicsmall26.7%● 0● 0GPT-5.6 LunaOpenAIfrontier21.7%● 0● 0Grok 4.5xAIfrontier20.0%● 0● 0Kimi K3Moonshotopen-weight16.7%● 0● 0GPT-5.6 SolOpenAIfrontier13.3%● 0● 0Claude Sonnet...