The Safety Guard Notices the Wrapper

A safety benchmark can accidentally reward a guard for recognizing the way a risky action is written instead of the risk itself. The Shortcut Sensitivity study separates three questions: whether labels can be predicted from superficial cues, whether guard decisions correlate with those cues and whether controlled rewrites actually change a decision. In LinuxArena, shorter average shell commands strongly predicted trajectory labels. Under domain holdout, an exact-tool lookup baseline on AgentDojo-Traj fell from an F1 of 0.901 to 0.495. On a fixed safe-row cohort, rewriting an information marker lowered blocking by 8.33 percentage points, while replacing tool names with opaque aliases raised it by 11.46 points; all unsafe calls in that screen remained blocked. The paired effects appeared for the tested Haiku configuration but not Luna or deterministic Q8 TS-Guard. The result is not a universal ranking of guards. It is evidence that representation shortcuts can alter both behavior and the score meant to measure safety.