Stringly-Typed Guardrails: how agent safety checks fail by matching the wrong thing

Automated excerpt

I will call it a stringly-typed guardrail: a safety check that makes its decision by matching patterns on surface text — the command string, a path as written, a secret as spelled — instead of on the ground truth it cares about: the file that is actually read, the action that is actually taken, whether a human can actually approve. Because many different strings denote the same real effect, anyone who wants past the guard just picks a spelling the pattern does not cover.

Selected automatically from source text; not independently written or fact-checked. Read the original for full context.