Large reasoning models are increasingly used in systems that can take actions, like reading emails or running tools. They produce an internal reasoning trace before answering, which helps them plan. This trace is usually hidden from the user. Attackers can inject text that looks like the model's own reasoning into the context the model sees. The model treats that fake reasoning as its own and follows its instructions.
The researchers tested this attack on several large, publicly available reasoning models. They first tried generic injection prompts with different wording and formatting. They found that success depended heavily on the specific model: some models were more vulnerable to certain styles or tags. Then they built a realistic agent scenario where the model could execute commands. They shaped the injection to copy the model's own reasoning style.
With this targeted approach, the attack succeeded about half the time on dangerous tasks like stealing data or planting backdoors. Normal that did not imitate reasoning never worked. This shows that mimicking a model's thinking style is a powerful way to bypass safety measures, and that removing special reasoning tags is not enough to stop it.