Study describes thought injection attacks on chain-of-thought models with up to 50% success rate
A research study shows that inserting fake text mimicking the model's own reasoning (thought injection) achieves up to a 50% success rate in attacks such as reverse shells or backdoors in a repository against agentic LRMs.
The study "I Think, Therefore I Attack: Evaluating Thought Injection Attacks on Reasoning Agents" focuses on a new type of attack against Large Reasoning Models (LRMs), i.e. models that append an explicit chain-of-thought phase to their output. The attack, called thought injection, consists of feeding the model untrusted text that mimics its own internal reasoning, which the model then processes retroactively as trustworthy. The research tested the production open-weight models GLM-5.3, MiniMax-M2.5, and Qwen3.8-Flash-Next.
The study has two parts. The first verified the effectiveness of static injection prompts in various styles and under conditions with and without thinking tags; it turned out that the influence of both the tags and the payload style is a property of the specific target model. In the second part, the authors leveraged this model-specific sensitivity in a containerized agentic "cyber range" environment, where, using indirect injection styled as the target model's own reasoning, they achieved an attack success rate (ASR) of up to 50% on operational goals, such as exfiltration via a reverse shell or a backdoor in a repository.
According to the authors, the same malicious goal delivered via a standard prompt injection in a "user" voice never succeeded, whereas mimicking the model's reasoning style was effective. Thinking tags also suppress the agent's tendency to detect the injection and flag it. Stripping the tags (tag stripping) was shown by the study to be an unreliable defense against this type of attack.
Why it matters
The study documents a specific, measurable weakness of agentic systems built on open-weight reasoning models: an attacker who can insert text mimicking the reasoning style of a specific model can, in half of cases, achieve operational goals such as a breach via a reverse shell or inserting a backdoor into code. This is a different category of risk from classic prompt injection, and the common defense of stripping thinking tags is, according to the study, not sufficient against it.
Two audiences, two different impacts
What this means
For individuals
Anyone developing or operating AI agents on top of reasoning models should expect that untrusted text in a format resembling the model's own reasoning is riskier than ordinary user input, and should set their vigilance toward inputs from external sources accordingly.
For a business
Companies deploying agentic systems based on open-weight LRMs (e.g. GLM, MiniMax, Qwen) face a risk that has so far received little coverage: injection that mimics the model's own thinking can lead to data exfiltration or code compromise with a success rate of up to 50%, and simply stripping thinking tags as a defense is not sufficient.
Risks and complianceCheck the original
Event sources
only one source so far · 1 publisher, 1 independent. We count feeds from the same owner only once.