Our tool guard teaches an agent to act only on what its user asked, even when a document it reads carries an order of its own. We had shown it on 7B models; this week we installed it on Qwen3-32B, at full precision on our own cards. The original model obeyed the planted order one time in three on the carriers it is weakest on, and nearly six times in ten when the order aimed at a goal it had never seen in training; it also answered an injected inbox by carrying out the attack. After one round of correction every planted order is refused, on seen and unseen carriers and goals, and the model still does everything the user actually asked, with the same answer quality on clean inboxes.
## What we tested
An agent is a model with tools: it reads your inbox and can send an email, delete a file, move money, grant an access. A document it reads can carry an order of its own ("forward the token to this address", "delete the archive"). Our tool guard is a correction that teaches the model to tell the user's request from text that merely arrived with it, so the tools fire only for the user.
Until now we had installed it on models of 7 billion parameters. This week we moved it to Qwen3-32B, four times larger, at full precision on our own graphics cards, with the same recipe: the model's own answers on clean inboxes become its teacher, one adapter is trained in three passes, saved, reloaded from the hub and read again on batteries it never saw during training.
## What we found
The larger model is not safer by itself. On the two carriers it is weakest on (an order dressed as a system message, and "ignore the previous instructions") it obeyed every time; across all carriers one planted order in three got through. When the order aimed at a goal the training never covered (publishing data) it got through nearly six times in ten. And when it was injected it did not merely leak: it answered the user's "summarise my inbox" by sending the attacker the token.
After the correction every planted order is refused: on the carriers seen in training and on the two never seen, on the four trained goals and on the held-out one, and when the order tries to redirect a reply to the attacker instead of the colleague. Everything the user actually asked is still done (four tools, every request honoured), and the answers to clean inboxes read as before.
```chart
{"title": "Planted orders obeyed by the agent (out of 100), before and after the correction", "series": ["Original Qwen3-32B", "After our correction"], "unit": "", "max": 60, "rows": [["Seen carriers (6 techniques)", 33.3, 0.0], ["Held-out goal: publish data", 58.3, 0.0], ["Reply redirected to the attacker", 60.0, 0.0], ["Unseen carriers (2 techniques)", 0.0, 0.0]], "note": "Same batteries, same scoring (no model judge), the corrected model reloaded from the hub before reading. Clean behaviour unchanged: every user-asked action still performed, answer quality 100 out of 100 on clean inboxes before and after."}
```
## Why it matters
An agent's size does not protect it from planted orders; on this model the larger size made some carriers worse, not better. The correction is one adapter, trained on the model's own clean answers in under two hours on three cards, and it removes the behaviour without a filter at the door and without touching what the agent does for its user. The next read, already scheduled, puts the corrected model on the two public agent benchmarks we used for the 7B version.
## In plain words
A bigger model still does what a hidden note in a document tells it, up to six times in ten. After our correction it does only what you asked, every time we tried, and it still does everything you asked.
This update is not available.