{"id":"908410d63ea0f33168aa291f1af935e3e789491ff59d05962ad3d8d430cd7b95","title":"arXiv cs.AI authors report thought injection attacks on reasoning agents","argument":"Parth Illendula, Garik Livingston, Zain Shamsi, Ravi Srinivasan and Alex Liu report that untrusted text styled like a model’s own reasoning can steer reasoning agents toward malicious objectives. They call this attack thought injection and compare it with standard prompt injection, where the malicious instruction is written in a user’s voice. In their tests, the effects of thinking tags and payload styles depended on the target model. In a containerized agentic cyber range, thought-injection prompts modeled on target reasoning traces achieved attack success rates up to 50% on objectives including reverse-shell exfiltration and repository backdooring; the same objectives in standard prompt injection user voice never succeeded. The authors also report that thinking tags suppressed the agent’s tendency to disclose the injection, and that tag stripping was an unreliable defense. Their findings suggest that defenses based on removing tags may not address attacks that imitate a model’s reasoning style. The abstract does not give details of the tested models’ configurations or how broadly the results extend beyond the reported cyber range.","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The evidence provided is the paper’s abstract; it does not detail the tested model configurations or establish how the results generalize beyond the reported containerized cyber range.","speaker":{"name":"Illendula, Parth, Livingston, Garik, Shamsi, Zain, Srinivasan, Ravi, Liu, Alex","roleAtSource":"Article author"},"source":{"title":"I Think, Therefore I Attack: Evaluating Thought Injection Attacks on Reasoning Agents","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2611.08811","publishedAt":"2026-11-06","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors define thought injection as feeding untrusted text resembling a model’s own deliberation back to the model.","excerpt":"thought injection, in which untrusted text resembling the model's own deliberation is fed back to the model.","url":"https://arxiv.org/abs/2611.08811","relationship":"Source-stated"},{"text":"The authors report that the effects of thinking tags and payload styles depend on the specific target model.","excerpt":"the effects of thinking tags and payload styles are all properties of the specific target model.","url":"https://arxiv.org/abs/2611.08811","relationship":"Source-stated"},{"text":"In a containerized agentic cyber range, the authors report attack success rates up to 50% on operational objectives, including reverse-shell exfiltration and repository backdooring.","excerpt":"using indirect injection prompts styled in the form of the target model's own reasoning traces to achieve attack success rates (ASR) up to 50% on operational objectives such as reverse-shell exfiltration and repository backdooring.","url":"https://arxiv.org/abs/2611.08811","relationship":"Source-stated"},{"text":"The authors report that the same malicious objective in standard prompt injection user voice never succeeded, while thinking tags suppressed disclosure of the injection.","excerpt":"the same malicious objective in standard prompt injection user voice never succeeds, and thinking tags suppress the agent's tendency to disclose the injection.","url":"https://arxiv.org/abs/2611.08811","relationship":"Source-stated"},{"text":"The authors conclude that tag stripping is an unreliable defense against this style of attack.","excerpt":"Our results show that imitating a reasoning model's own thought style is effective for this style of attack, and that tag stripping is an unreliable defense.","url":"https://arxiv.org/abs/2611.08811","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.08811","checkedAt":"2026-11-13T01:06:08.120Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How do these results vary across model configurations and beyond the containerized cyber range?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"arXiv cs.AI authors report thought injection attacks on reasoning agents","summary":"Parth Illendula, Garik Livingston, Zain Shamsi, Ravi Srinivasan and Alex Liu report that untrusted text styled like a model’s own reasoning can steer reasoning agents toward malicious objectives. They call this attack thought injection and compare it with standard prompt injection, where the malicious instruction is written in a user’s voice. In their tests, the effects of thinking tags and payload styles depended on the target model. In a containerized agentic cyber range, thought-injection prompts modeled on target reasoning traces achieved attack success rates up to 50% on objectives including reverse-shell exfiltration and repository backdooring; the same objectives in standard prompt injection user voice never succeeded. The authors also report that thinking tags suppressed the agent’s tendency to disclose the injection, and that tag stripping was an unreliable defense. Their findings suggest that defenses based on removing tags may not address attacks that imitate a model’s reasoning style. The abstract does not give details of the tested models’ configurations or how broadly the results extend beyond the reported cyber range.","question":"How do these results vary across model configurations and beyond the containerized cyber range?","claims":[{"text":"The authors define thought injection as feeding untrusted text resembling a model’s own deliberation back to the model.","excerpt":"thought injection, in which untrusted text resembling the model's own deliberation is fed back to the model.","support":"source-stated"},{"text":"The authors report that the effects of thinking tags and payload styles depend on the specific target model.","excerpt":"the effects of thinking tags and payload styles are all properties of the specific target model.","support":"source-stated"},{"text":"In a containerized agentic cyber range, the authors report attack success rates up to 50% on operational objectives, including reverse-shell exfiltration and repository backdooring.","excerpt":"using indirect injection prompts styled in the form of the target model's own reasoning traces to achieve attack success rates (ASR) up to 50% on operational objectives such as reverse-shell exfiltration and repository backdooring.","support":"source-stated"},{"text":"The authors report that the same malicious objective in standard prompt injection user voice never succeeded, while thinking tags suppressed disclosure of the injection.","excerpt":"the same malicious objective in standard prompt injection user voice never succeeds, and thinking tags suppress the agent's tendency to disclose the injection.","support":"source-stated"},{"text":"The authors conclude that tag stripping is an unreliable defense against this style of attack.","excerpt":"Our results show that imitating a reasoning model's own thought style is effective for this style of attack, and that tag stripping is an unreliable defense.","support":"source-stated"}],"limitations":["The evidence provided is the paper’s abstract; it does not detail the tested model configurations or establish how the results generalize beyond the reported containerized cyber range."],"mediaId":"02549b848fe2d54b19e3035472d46098e7bce8b34b885581ece05bdc7ab2708c","correctionReason":null,"id":"908410d63ea0f33168aa291f1af935e3e789491ff59d05962ad3d8d430cd7b95","publicationId":"cf76155d-3013-4c98-8d6e-decb0b469e6f","version":1,"sourceUrl":"https://arxiv.org/abs/2611.08811","sourceTitle":"I Think, Therefore I Attack: Evaluating Thought Injection Attacks on Reasoning Agents","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-11-06","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-11-09T05:00:38.687Z","createdAt":"2026-11-13T00:03:06.755Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"02549b848fe2d54b19e3035472d46098e7bce8b34b885581ece05bdc7ab2708c","kind":"article","url":"https://arxiv.org/abs/2611.08811","sourceUrl":"https://arxiv.org/abs/2611.08811","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-13T00:02:14.889Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.08811","checkedAt":"2026-11-13T01:06:08.120Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v6","mediaId":"02549b848fe2d54b19e3035472d46098e7bce8b34b885581ece05bdc7ab2708c","confidence":0.75,"provider":"typesafe","model":"jev-1.13.0","inputHash":"53167db01031e0d82440231d5a5ea221432c05c4f3a3fd9fbdc716673c01b61b","decidedAt":"2026-11-13T00:02:16.218Z"},"provenance":{"textHash":"0e274d9a766bc8f560ba18b4698a4ddd5a8627d4006c3201ad40c3ad21b9c4af","observationId":"17af358637a06a556219a314f74214e20aee02c587acd9eded7c61e86d38e91c","retrievedAt":"2026-11-13T00:02:14.776Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"ae44fdbc-11fe-4214-8982-48f46909e8fe"},"reviewer":{"model":"gpt-6-luna","runId":"3e5c07de-fd97-413d-84d0-724adf3e7f23"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-13T00:03:06.755Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Illendula, Parth","url":null,"kind":"unknown"},{"name":"Livingston, Garik","url":null,"kind":"unknown"},{"name":"Shamsi, Zain","url":null,"kind":"unknown"},{"name":"Srinivasan, Ravi","url":null,"kind":"unknown"},{"name":"Liu, Alex","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Illendula, Parth","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Illendula, Parth","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.08811","locator":"head/meta[name=author|citation_author]"},"assertionId":"a3e1e8afc8acadbcd77b3eb52743a770ea894f3eaef0e50c1c4423d8d05f594a:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-13T01:06:08.120Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"a3e1e8afc8acadbcd77b3eb52743a770ea894f3eaef0e50c1c4423d8d05f594a","sourceUrl":"https://arxiv.org/abs/2611.08811","contentSha256":"a97c7fd02a6e570aa5be491ce5800429ed72f4ce9e2c3a0061dd9cd5aa2e75cf","textHash":"0e274d9a766bc8f560ba18b4698a4ddd5a8627d4006c3201ad40c3ad21b9c4af","observedAt":"2026-11-13T01:06:08.120Z"}},{"actor":{"name":"Livingston, Garik","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Livingston, Garik","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.08811","locator":"head/meta[name=author|citation_author]"},"assertionId":"a3e1e8afc8acadbcd77b3eb52743a770ea894f3eaef0e50c1c4423d8d05f594a:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-13T01:06:08.120Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"a3e1e8afc8acadbcd77b3eb52743a770ea894f3eaef0e50c1c4423d8d05f594a","sourceUrl":"https://arxiv.org/abs/2611.08811","contentSha256":"a97c7fd02a6e570aa5be491ce5800429ed72f4ce9e2c3a0061dd9cd5aa2e75cf","textHash":"0e274d9a766bc8f560ba18b4698a4ddd5a8627d4006c3201ad40c3ad21b9c4af","observedAt":"2026-11-13T01:06:08.120Z"}},{"actor":{"name":"Shamsi, Zain","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Shamsi, Zain","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.08811","locator":"head/meta[name=author|citation_author]"},"assertionId":"a3e1e8afc8acadbcd77b3eb52743a770ea894f3eaef0e50c1c4423d8d05f594a:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-13T01:06:08.120Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"a3e1e8afc8acadbcd77b3eb52743a770ea894f3eaef0e50c1c4423d8d05f594a","sourceUrl":"https://arxiv.org/abs/2611.08811","contentSha256":"a97c7fd02a6e570aa5be491ce5800429ed72f4ce9e2c3a0061dd9cd5aa2e75cf","textHash":"0e274d9a766bc8f560ba18b4698a4ddd5a8627d4006c3201ad40c3ad21b9c4af","observedAt":"2026-11-13T01:06:08.120Z"}},{"actor":{"name":"Srinivasan, Ravi","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Srinivasan, Ravi","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.08811","locator":"head/meta[name=author|citation_author]"},"assertionId":"a3e1e8afc8acadbcd77b3eb52743a770ea894f3eaef0e50c1c4423d8d05f594a:participation:3","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-13T01:06:08.120Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"a3e1e8afc8acadbcd77b3eb52743a770ea894f3eaef0e50c1c4423d8d05f594a","sourceUrl":"https://arxiv.org/abs/2611.08811","contentSha256":"a97c7fd02a6e570aa5be491ce5800429ed72f4ce9e2c3a0061dd9cd5aa2e75cf","textHash":"0e274d9a766bc8f560ba18b4698a4ddd5a8627d4006c3201ad40c3ad21b9c4af","observedAt":"2026-11-13T01:06:08.120Z"}},{"actor":{"name":"Liu, Alex","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Liu, Alex","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.08811","locator":"head/meta[name=author|citation_author]"},"assertionId":"a3e1e8afc8acadbcd77b3eb52743a770ea894f3eaef0e50c1c4423d8d05f594a:participation:4","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-13T01:06:08.120Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"a3e1e8afc8acadbcd77b3eb52743a770ea894f3eaef0e50c1c4423d8d05f594a","sourceUrl":"https://arxiv.org/abs/2611.08811","contentSha256":"a97c7fd02a6e570aa5be491ce5800429ed72f4ce9e2c3a0061dd9cd5aa2e75cf","textHash":"0e274d9a766bc8f560ba18b4698a4ddd5a8627d4006c3201ad40c3ad21b9c4af","observedAt":"2026-11-13T01:06:08.120Z"}}],"participationCoverage":{"total":5,"returned":5,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2611.08811","snapshotId":"a3e1e8afc8acadbcd77b3eb52743a770ea894f3eaef0e50c1c4423d8d05f594a","contentSha256":"a97c7fd02a6e570aa5be491ce5800429ed72f4ce9e2c3a0061dd9cd5aa2e75cf","textHash":"0e274d9a766bc8f560ba18b4698a4ddd5a8627d4006c3201ad40c3ad21b9c4af","observedAt":"2026-11-13T01:06:08.120Z","basis":"publisher-page-metadata","sourceLinks":44,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/908410d63ea0f33168aa291f1af935e3e789491ff59d05962ad3d8d430cd7b95/source"}},"canonicalUrl":"https://escapemeridian.com/readings/arxiv-cs-ai-authors-report-thought-injection-attacks-on-908410d6","formats":{"html":"/readings/arxiv-cs-ai-authors-report-thought-injection-attacks-on-908410d6","markdown":"/readings/arxiv-cs-ai-authors-report-thought-injection-attacks-on-908410d6.md","json":"/readings/arxiv-cs-ai-authors-report-thought-injection-attacks-on-908410d6.json"},"attribution":"Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.","maintainedGuideLinks":[],"readerContext":{"version":"reader-context-v1","attribution":"Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.","terms":[{"id":"term-prompt-injection","name":"Prompt injection","explanation":"Hidden instructions placed in a document, email or web page that try to take control of an AI system reading it.","referenceUrl":"https://en.wikipedia.org/wiki/Prompt_injection"},{"id":"term-agentic","name":"Agentic AI","explanation":"AI systems that plan and carry out a series of steps toward a goal, often by using other software, rather than giving one answer.","referenceUrl":"https://developers.google.com/machine-learning/glossary#agentic"},{"id":"term-chain-of-thought","name":"Chain of thought","explanation":"The step-by-step working a model writes out before giving its final answer.","referenceUrl":"https://developers.google.com/machine-learning/glossary#chain-of-thought-prompting"}],"entities":[{"id":"arxiv","name":"arXiv","kind":"organization","context":"arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.","referenceUrls":["https://arxiv.org/","https://info.arxiv.org/help/api/index.html"],"path":"/entities/arxiv","json":"/entities/arxiv.json","markdown":"/entities/arxiv.md"}]},"researchQuestions":[],"withdrawn":false,"references":{"schemaVersion":1,"target":{"type":"reading","id":"908410d63ea0f33168aa291f1af935e3e789491ff59d05962ad3d8d430cd7b95","revision":"cf76155d-3013-4c98-8d6e-decb0b469e6f","revisionKind":"publication-id","title":"arXiv cs.AI authors report thought injection attacks on reasoning agents","url":"https://escapemeridian.com/readings/arxiv-cs-ai-authors-report-thought-injection-attacks-on-908410d6"},"source":{"type":"source","id":"https://arxiv.org/abs/2611.08811","revision":"0e274d9a766bc8f560ba18b4698a4ddd5a8627d4006c3201ad40c3ad21b9c4af","revisionKind":"sha256-source-text","title":"I Think, Therefore I Attack: Evaluating Thought Injection Attacks on Reasoning Agents","url":"https://arxiv.org/abs/2611.08811"},"status":"available","items":[],"next":null,"scope":"Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter."},"revisions":[{"id":"908410d63ea0f33168aa291f1af935e3e789491ff59d05962ad3d8d430cd7b95","title":"arXiv cs.AI authors report thought injection attacks on reasoning agents","argument":"Parth Illendula, Garik Livingston, Zain Shamsi, Ravi Srinivasan and Alex Liu report that untrusted text styled like a model’s own reasoning can steer reasoning agents toward malicious objectives. They call this attack thought injection and compare it with standard prompt injection, where the malicious instruction is written in a user’s voice. In their tests, the effects of thinking tags and payload styles depended on the target model. In a containerized agentic cyber range, thought-injection prompts modeled on target reasoning traces achieved attack success rates up to 50% on objectives including reverse-shell exfiltration and repository backdooring; the same objectives in standard prompt injection user voice never succeeded. The authors also report that thinking tags suppressed the agent’s tendency to disclose the injection, and that tag stripping was an unreliable defense. Their findings suggest that defenses based on removing tags may not address attacks that imitate a model’s reasoning style. The abstract does not give details of the tested models’ configurations or how broadly the results extend beyond the reported cyber range.","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The evidence provided is the paper’s abstract; it does not detail the tested model configurations or establish how the results generalize beyond the reported containerized cyber range.","speaker":{"name":"Illendula, Parth, Livingston, Garik, Shamsi, Zain, Srinivasan, Ravi, Liu, Alex","roleAtSource":"Article author"},"source":{"title":"I Think, Therefore I Attack: Evaluating Thought Injection Attacks on Reasoning Agents","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2611.08811","publishedAt":"2026-11-06","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors define thought injection as feeding untrusted text resembling a model’s own deliberation back to the model.","excerpt":"thought injection, in which untrusted text resembling the model's own deliberation is fed back to the model.","url":"https://arxiv.org/abs/2611.08811","relationship":"Source-stated"},{"text":"The authors report that the effects of thinking tags and payload styles depend on the specific target model.","excerpt":"the effects of thinking tags and payload styles are all properties of the specific target model.","url":"https://arxiv.org/abs/2611.08811","relationship":"Source-stated"},{"text":"In a containerized agentic cyber range, the authors report attack success rates up to 50% on operational objectives, including reverse-shell exfiltration and repository backdooring.","excerpt":"using indirect injection prompts styled in the form of the target model's own reasoning traces to achieve attack success rates (ASR) up to 50% on operational objectives such as reverse-shell exfiltration and repository backdooring.","url":"https://arxiv.org/abs/2611.08811","relationship":"Source-stated"},{"text":"The authors report that the same malicious objective in standard prompt injection user voice never succeeded, while thinking tags suppressed disclosure of the injection.","excerpt":"the same malicious objective in standard prompt injection user voice never succeeds, and thinking tags suppress the agent's tendency to disclose the injection.","url":"https://arxiv.org/abs/2611.08811","relationship":"Source-stated"},{"text":"The authors conclude that tag stripping is an unreliable defense against this style of attack.","excerpt":"Our results show that imitating a reasoning model's own thought style is effective for this style of attack, and that tag stripping is an unreliable defense.","url":"https://arxiv.org/abs/2611.08811","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.08811","checkedAt":"2026-11-13T01:06:08.120Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How do these results vary across model configurations and beyond the containerized cyber range?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"arXiv cs.AI authors report thought injection attacks on reasoning agents","summary":"Parth Illendula, Garik Livingston, Zain Shamsi, Ravi Srinivasan and Alex Liu report that untrusted text styled like a model’s own reasoning can steer reasoning agents toward malicious objectives. They call this attack thought injection and compare it with standard prompt injection, where the malicious instruction is written in a user’s voice. In their tests, the effects of thinking tags and payload styles depended on the target model. In a containerized agentic cyber range, thought-injection prompts modeled on target reasoning traces achieved attack success rates up to 50% on objectives including reverse-shell exfiltration and repository backdooring; the same objectives in standard prompt injection user voice never succeeded. The authors also report that thinking tags suppressed the agent’s tendency to disclose the injection, and that tag stripping was an unreliable defense. Their findings suggest that defenses based on removing tags may not address attacks that imitate a model’s reasoning style. The abstract does not give details of the tested models’ configurations or how broadly the results extend beyond the reported cyber range.","question":"How do these results vary across model configurations and beyond the containerized cyber range?","claims":[{"text":"The authors define thought injection as feeding untrusted text resembling a model’s own deliberation back to the model.","excerpt":"thought injection, in which untrusted text resembling the model's own deliberation is fed back to the model.","support":"source-stated"},{"text":"The authors report that the effects of thinking tags and payload styles depend on the specific target model.","excerpt":"the effects of thinking tags and payload styles are all properties of the specific target model.","support":"source-stated"},{"text":"In a containerized agentic cyber range, the authors report attack success rates up to 50% on operational objectives, including reverse-shell exfiltration and repository backdooring.","excerpt":"using indirect injection prompts styled in the form of the target model's own reasoning traces to achieve attack success rates (ASR) up to 50% on operational objectives such as reverse-shell exfiltration and repository backdooring.","support":"source-stated"},{"text":"The authors report that the same malicious objective in standard prompt injection user voice never succeeded, while thinking tags suppressed disclosure of the injection.","excerpt":"the same malicious objective in standard prompt injection user voice never succeeds, and thinking tags suppress the agent's tendency to disclose the injection.","support":"source-stated"},{"text":"The authors conclude that tag stripping is an unreliable defense against this style of attack.","excerpt":"Our results show that imitating a reasoning model's own thought style is effective for this style of attack, and that tag stripping is an unreliable defense.","support":"source-stated"}],"limitations":["The evidence provided is the paper’s abstract; it does not detail the tested model configurations or establish how the results generalize beyond the reported containerized cyber range."],"mediaId":"02549b848fe2d54b19e3035472d46098e7bce8b34b885581ece05bdc7ab2708c","correctionReason":null,"id":"908410d63ea0f33168aa291f1af935e3e789491ff59d05962ad3d8d430cd7b95","publicationId":"cf76155d-3013-4c98-8d6e-decb0b469e6f","version":1,"sourceUrl":"https://arxiv.org/abs/2611.08811","sourceTitle":"I Think, Therefore I Attack: Evaluating Thought Injection Attacks on Reasoning Agents","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-11-06","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-11-09T05:00:38.687Z","createdAt":"2026-11-13T00:03:06.755Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"02549b848fe2d54b19e3035472d46098e7bce8b34b885581ece05bdc7ab2708c","kind":"article","url":"https://arxiv.org/abs/2611.08811","sourceUrl":"https://arxiv.org/abs/2611.08811","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-13T00:02:14.889Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.08811","checkedAt":"2026-11-13T01:06:08.120Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v6","mediaId":"02549b848fe2d54b19e3035472d46098e7bce8b34b885581ece05bdc7ab2708c","confidence":0.75,"provider":"typesafe","model":"jev-1.13.0","inputHash":"53167db01031e0d82440231d5a5ea221432c05c4f3a3fd9fbdc716673c01b61b","decidedAt":"2026-11-13T00:02:16.218Z"},"provenance":{"textHash":"0e274d9a766bc8f560ba18b4698a4ddd5a8627d4006c3201ad40c3ad21b9c4af","observationId":"17af358637a06a556219a314f74214e20aee02c587acd9eded7c61e86d38e91c","retrievedAt":"2026-11-13T00:02:14.776Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"ae44fdbc-11fe-4214-8982-48f46909e8fe"},"reviewer":{"model":"gpt-6-luna","runId":"3e5c07de-fd97-413d-84d0-724adf3e7f23"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-13T00:03:06.755Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Illendula, Parth","url":null,"kind":"unknown"},{"name":"Livingston, Garik","url":null,"kind":"unknown"},{"name":"Shamsi, Zain","url":null,"kind":"unknown"},{"name":"Srinivasan, Ravi","url":null,"kind":"unknown"},{"name":"Liu, Alex","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Illendula, Parth","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Illendula, Parth","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.08811","locator":"head/meta[name=author|citation_author]"},"assertionId":"a3e1e8afc8acadbcd77b3eb52743a770ea894f3eaef0e50c1c4423d8d05f594a:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-13T01:06:08.120Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"a3e1e8afc8acadbcd77b3eb52743a770ea894f3eaef0e50c1c4423d8d05f594a","sourceUrl":"https://arxiv.org/abs/2611.08811","contentSha256":"a97c7fd02a6e570aa5be491ce5800429ed72f4ce9e2c3a0061dd9cd5aa2e75cf","textHash":"0e274d9a766bc8f560ba18b4698a4ddd5a8627d4006c3201ad40c3ad21b9c4af","observedAt":"2026-11-13T01:06:08.120Z"}},{"actor":{"name":"Livingston, Garik","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Livingston, Garik","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.08811","locator":"head/meta[name=author|citation_author]"},"assertionId":"a3e1e8afc8acadbcd77b3eb52743a770ea894f3eaef0e50c1c4423d8d05f594a:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-13T01:06:08.120Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"a3e1e8afc8acadbcd77b3eb52743a770ea894f3eaef0e50c1c4423d8d05f594a","sourceUrl":"https://arxiv.org/abs/2611.08811","contentSha256":"a97c7fd02a6e570aa5be491ce5800429ed72f4ce9e2c3a0061dd9cd5aa2e75cf","textHash":"0e274d9a766bc8f560ba18b4698a4ddd5a8627d4006c3201ad40c3ad21b9c4af","observedAt":"2026-11-13T01:06:08.120Z"}},{"actor":{"name":"Shamsi, Zain","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Shamsi, Zain","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.08811","locator":"head/meta[name=author|citation_author]"},"assertionId":"a3e1e8afc8acadbcd77b3eb52743a770ea894f3eaef0e50c1c4423d8d05f594a:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-13T01:06:08.120Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"a3e1e8afc8acadbcd77b3eb52743a770ea894f3eaef0e50c1c4423d8d05f594a","sourceUrl":"https://arxiv.org/abs/2611.08811","contentSha256":"a97c7fd02a6e570aa5be491ce5800429ed72f4ce9e2c3a0061dd9cd5aa2e75cf","textHash":"0e274d9a766bc8f560ba18b4698a4ddd5a8627d4006c3201ad40c3ad21b9c4af","observedAt":"2026-11-13T01:06:08.120Z"}},{"actor":{"name":"Srinivasan, Ravi","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Srinivasan, Ravi","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.08811","locator":"head/meta[name=author|citation_author]"},"assertionId":"a3e1e8afc8acadbcd77b3eb52743a770ea894f3eaef0e50c1c4423d8d05f594a:participation:3","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-13T01:06:08.120Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"a3e1e8afc8acadbcd77b3eb52743a770ea894f3eaef0e50c1c4423d8d05f594a","sourceUrl":"https://arxiv.org/abs/2611.08811","contentSha256":"a97c7fd02a6e570aa5be491ce5800429ed72f4ce9e2c3a0061dd9cd5aa2e75cf","textHash":"0e274d9a766bc8f560ba18b4698a4ddd5a8627d4006c3201ad40c3ad21b9c4af","observedAt":"2026-11-13T01:06:08.120Z"}},{"actor":{"name":"Liu, Alex","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Liu, Alex","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.08811","locator":"head/meta[name=author|citation_author]"},"assertionId":"a3e1e8afc8acadbcd77b3eb52743a770ea894f3eaef0e50c1c4423d8d05f594a:participation:4","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-13T01:06:08.120Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"a3e1e8afc8acadbcd77b3eb52743a770ea894f3eaef0e50c1c4423d8d05f594a","sourceUrl":"https://arxiv.org/abs/2611.08811","contentSha256":"a97c7fd02a6e570aa5be491ce5800429ed72f4ce9e2c3a0061dd9cd5aa2e75cf","textHash":"0e274d9a766bc8f560ba18b4698a4ddd5a8627d4006c3201ad40c3ad21b9c4af","observedAt":"2026-11-13T01:06:08.120Z"}}],"participationCoverage":{"total":5,"returned":5,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2611.08811","snapshotId":"a3e1e8afc8acadbcd77b3eb52743a770ea894f3eaef0e50c1c4423d8d05f594a","contentSha256":"a97c7fd02a6e570aa5be491ce5800429ed72f4ce9e2c3a0061dd9cd5aa2e75cf","textHash":"0e274d9a766bc8f560ba18b4698a4ddd5a8627d4006c3201ad40c3ad21b9c4af","observedAt":"2026-11-13T01:06:08.120Z","basis":"publisher-page-metadata","sourceLinks":44,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/908410d63ea0f33168aa291f1af935e3e789491ff59d05962ad3d8d430cd7b95/source"}}}],"audits":[{"publicationId":"cf76155d-3013-4c98-8d6e-decb0b469e6f","verdict":"uncertain","findings":[{"dimension":"attribution","status":"pass","explanation":"The five named authors match the arXiv listing. Findings are consistently framed as what the authors report or conclude, not as established fact.","excerpt":"Authors:Parth Illendula, Garik Livingston, Zain Shamsi, Ravi Srinivasan, Alex Liu"},{"dimension":"summary","status":"uncertain","explanation":"The reading is faithful, but two gaps limit understanding. First, it never explains central terms such as thinking tags, tag stripping, agentic cyber range, reverse-shell exfiltration or repository backdooring. A non-specialist cannot tell what the 50% success rate means or why tag stripping matters. Second, it drops the scope: tests targeted large, production-class open-weight models such as GLM-5.3, MiniMax-M2.5 and Qwen3.8-Flash-Next. Smallest repair: name those models, and add brief plain-language glosses or tooltips for thinking tags and the attack objectives.","excerpt":"performed against the prevailing large, production class open-weight models (e.g., GLM-5.3, MiniMax-M2.5, Qwen3.8-Flash-Next)"},{"dimension":"date","status":"pass","explanation":"originalPublished is 2026-11-06, which matches the v1 submission date. The 2026-11-09 feed date is correctly not used.","excerpt":"[Submitted on 6 Nov 2026]"},{"dimension":"support","status":"pass","explanation":"Each claim matches its excerpt. This includes the 50% ASR ceiling, the result that user-voice injection never succeeded, the tag-suppression finding and the unreliability of tag stripping. The sentence that tag-removal defenses may not address style-imitating attacks closely restates the authors' conclusion rather than adding an unsupported inference. The stated limitation and the question reasonably follow from the evidence.","excerpt":"Our results show that imitating a reasoning model's own thought style is effective for this style of attack, and that tag stripping is an unreliable defense."},{"dimension":"media","status":"pass","explanation":"The selected media is the verified arXiv abstract page for this paper, which is the direct original source.","excerpt":null}],"createdAt":"2026-11-13T00:03:06.755Z","model":"anthropic/claude-opus-5.5"}],"correctionUrl":"https://escapemeridian.com/corrections/"}