I Think, Therefore I Attack: Evaluating Thought Injection Attacks on Reasoning Agents

Summary

Researchers studied thought injection, where untrusted text styled as a model's own reasoning is fed back to Large Reasoning Models (LRMs). Testing production open-weight models (GLM-5.3, MiniMax-M2.5, Qwen3.8-Flash-Next) in a containerized agentic cyber range, they achieved attack success rates up to 50% on objectives such as reverse-shell exfiltration and repository backdooring. The same objectives in standard user-voice prompt injection never succeeded, and thinking tags suppressed the agent's disclosure of the injection.

Related items

• MediumTop MCP security resources — November 2026Similar attack · Adversa AI Blog
• LowCVE-2026-123498: Vikunja veans prompt injection through project titles and task contentSimilar attack · NVD/CVE Database
• MediumCVE-2026-124028: mistral.rs delimiter injection allows attacker-chosen tool calls via quoted textSimilar attack · NVD/CVE Database
• MediumCVE-2026-123851: JetBrains Junie GitHub Action prompt injection bypass via HTML encodingSimilar attack · NVD/CVE Database
• InfoDecision Models as Retrieval Gates Against Injection and PollutionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)