{"slug": "i-think-therefore-i-attack", "title": "I Think, Therefore I Attack", "summary": "A two-part arXiv study submitted on 6 Nov 2026 found that thought-injection attacks, which feed untrusted text styled as a model's own chain-of-thought back into large reasoning models, achieved attack success rates up to 50% on operational objectives including reverse-shell exfiltration and repository backdooring in a containerized agentic cyber range. The study tested prevailing production-class open-weight models, including GLM-5.3, MiniMax-M2.5 and Qwen3.8-Flash-Next, and found that the effects of thinking tags and payload styles are properties of the specific target model. The same malicious objective delivered in standard prompt-injection user voice never succeeded, and the authors concluded that tag stripping is an unreliable defense because thinking tags suppress an agent's tendency to disclose the injection.", "body_md": "# Computer Science > Artificial Intelligence\n\n  [Submitted on 6 Nov 2026]\n\n# Title:I Think, Therefore I Attack: Evaluating Thought Injection Attacks on Reasoning Agents\n\n[View PDF](https://arxiv.org/pdf/2611.08811)\n\n[HTML (experimental)](https://arxiv.org/html/2611.08811v1)\n\nAbstract:Large Reasoning Models (LRMs) are one of the key components of current agentic systems. LRMs augment their output with an explicit chain-of-thought reasoning stage, introducing a new attack surface for thought injection, in which untrusted text resembling the model's own deliberation is fed back to the model. We present a two-part study of this attack, performed against the prevailing large, production class open-weight models (e.g., GLM-5.3, MiniMax-M2.5, Qwen3.8-Flash-Next). We first evaluate the effectiveness of static thought-injection prompts under different styles as well as tagged and untagged conditions and find that the effects of thinking tags and payload styles are all properties of the specific target model. In the second study, we exploit this model-specificity in a containerized agentic cyber range, using indirect injection prompts styled in the form of the target model's own reasoning traces to achieve attack success rates (ASR) up to 50% on operational objectives such as reverse-shell exfiltration and repository backdooring. We also find that the same malicious objective in standard prompt injection user voice never succeeds, and thinking tags suppress the agent's tendency to disclose the injection. Our results show that imitating a reasoning model's own thought style is effective for this style of attack, and that tag stripping is an unreliable defense.\n    \n\n### Additional Features\n\n### References & Citations\n\nLoading...\n\n# Bibliographic and Citation Tools\n\nBibliographic Explorer \n\n*(*[What is the Explorer?](https://info.arxiv.org/labs/showcase.html#arxiv-bibliographic-explorer))\nConnected Papers \n\n*(*[What is Connected Papers?](https://www.connectedpapers.com/about))\nLitmaps \n\n*(*[What is Litmaps?](https://www.litmaps.co/))\nscite Smart Citations \n\n*(*[What are Smart Citations?](https://www.scite.ai/))\n# Code, Data and Media Associated with this Article\n\nalphaXiv \n\n*(*[What is alphaXiv?](https://alphaxiv.org/))\nCatalyzeX Code Finder for Papers \n\n*(*[What is CatalyzeX?](https://www.catalyzex.com))\nDagsHub \n\n*(*[What is DagsHub?](https://dagshub.com/))\nGotit.pub \n\n*(*[What is GotitPub?](http://gotit.pub/faq))\nHugging Face \n\n*(*[What is Huggingface?](https://huggingface.co/huggingface))\nScienceCast \n\n*(*[What is ScienceCast?](https://sciencecast.org/welcome))\n# Demos\n\n# Recommenders and Search Tools\n\nInfluence Flower \n\n*(*[What are Influence Flowers?](https://influencemap.cmlab.dev/))\nCORE Recommender \n\n*(*[What is CORE?](https://core.ac.uk/services/recommender))\n# arXivLabs: experimental projects with community collaborators\n\narXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.\n\nBoth individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.\n\nHave an idea for a project that will add value for arXiv's community? [**Learn more about arXivLabs**](https://info.arxiv.org/labs/index.html).", "url": "https://wpnews.pro/news/i-think-therefore-i-attack", "canonical_source": "https://arxiv.org/abs/2611.08811", "published_at": "2026-11-09 21:58:19+00:00", "updated_at": "2026-11-09 22:21:55.732449+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "large-language-models", "ai-research", "artificial-intelligence"], "entities": ["arXiv", "GLM-5.3", "MiniMax-M2.5", "Qwen3.8-Flash-Next"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/i-think-therefore-i-attack", "markdown": "https://wpnews.pro/news/i-think-therefore-i-attack.md", "text": "https://wpnews.pro/news/i-think-therefore-i-attack.txt", "jsonld": "https://wpnews.pro/news/i-think-therefore-i-attack.jsonld"}}