I Think, Therefore I Attack

A two-part arXiv study submitted on 6 Nov 2026 found that thought-injection attacks, which feed untrusted text styled as a model's own chain-of-thought back into large reasoning models, achieved attack success rates up to 50% on operational objectives including reverse-shell exfiltration and repository backdooring in a containerized agentic cyber range. The study tested prevailing production-class open-weight models, including GLM-5.3, MiniMax-M2.5 and Qwen3.8-Flash-Next, and found that the effects of thinking tags and payload styles are properties of the specific target model. The same malicious objective delivered in standard prompt-injection user voice never succeeded, and the authors concluded that tag stripping is an unreliable defense because thinking tags suppress an agent's tendency to disclose the injection.

Computer Science Artificial Intelligence Submitted on 6 Nov 2026 Title:I Think, Therefore I Attack: Evaluating Thought Injection Attacks on Reasoning Agents View PDF https://arxiv.org/pdf/2611.08811 HTML experimental https://arxiv.org/html/2611.08811v1 Abstract:Large Reasoning Models LRMs are one of the key components of current agentic systems. LRMs augment their output with an explicit chain-of-thought reasoning stage, introducing a new attack surface for thought injection, in which untrusted text resembling the model's own deliberation is fed back to the model. We present a two-part study of this attack, performed against the prevailing large, production class open-weight models e.g., GLM-5.3, MiniMax-M2.5, Qwen3.8-Flash-Next . We first evaluate the effectiveness of static thought-injection prompts under different styles as well as tagged and untagged conditions and find that the effects of thinking tags and payload styles are all properties of the specific target model. In the second study, we exploit this model-specificity in a containerized agentic cyber range, using indirect injection prompts styled in the form of the target model's own reasoning traces to achieve attack success rates ASR up to 50% on operational objectives such as reverse-shell exfiltration and repository backdooring. We also find that the same malicious objective in standard prompt injection user voice never succeeds, and thinking tags suppress the agent's tendency to disclose the injection. Our results show that imitating a reasoning model's own thought style is effective for this style of attack, and that tag stripping is an unreliable defense. Additional Features References & Citations Loading... Bibliographic and Citation Tools Bibliographic Explorer What is the Explorer? https://info.arxiv.org/labs/showcase.html arxiv-bibliographic-explorer Connected Papers What is Connected Papers? https://www.connectedpapers.com/about Litmaps What is Litmaps? https://www.litmaps.co/ scite Smart Citations What are Smart Citations? https://www.scite.ai/ Code, Data and Media Associated with this Article alphaXiv What is alphaXiv? https://alphaxiv.org/ CatalyzeX Code Finder for Papers What is CatalyzeX? https://www.catalyzex.com DagsHub What is DagsHub? https://dagshub.com/ Gotit.pub What is GotitPub? http://gotit.pub/faq Hugging Face What is Huggingface? https://huggingface.co/huggingface ScienceCast What is ScienceCast? https://sciencecast.org/welcome Demos Recommenders and Search Tools Influence Flower What are Influence Flowers? https://influencemap.cmlab.dev/ CORE Recommender What is CORE? https://core.ac.uk/services/recommender arXivLabs: experimental projects with community collaborators arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website. Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them. Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs https://info.arxiv.org/labs/index.html .