I Think, Therefore I Attack: Evaluating Thought Injection Attacks on Reasoning Agents
Summary
- Researchers introduce thought injection attacks targeting Large Reasoning Models that use explicit chains-of-thought.
- The study tests production open-weight models like GLM-5.3, MiniMax-M2.5, and Qwen3.8-Flash-Next.
- Imitating a target model's reasoning style achieves attack success rates up to 50% on operational objectives like backdooring.
- Results show that standard prompt injection fails while thought injection succeeds, and thinking tags suppress disclosure.
Why it matters
Thought injection represents a significant vulnerability for agentic systems built on Large Reasoning Models, demonstrating that attackers can bypass traditional prompt injection defenses by mimicking internal reasoning traces.