A thought that copies a model style gets control of AI agents

Researchers did tests on thought injection with three large open-weight models: GLM-5.3, MiniMax-M2.5 and Qwen3.8-Flash-Next. In this attack, the agent gets untrusted text that copies its reasoning. In a test network, the attack got a success rate of 50% at most on goals such as a reverse shell (a connection that sends data out) and a backdoor. The same goals in a usual user voice did not work.

How it works

A reasoning model writes a chain of thought (step by step reasoning text) before it gives an answer. The attacker puts text in content that the agent reads. The text copies the style of the model reasoning, and the model can use it as its thought.

The numbers

• Success rate of 50% at most on goals in the test network
• Success rate of 0% for the same goals in user voice
• Thinking tags cause agents to tell less about the injection

What is not known

The effect of tags and text styles is different for each model. One defense can be of no use on the next model. The authors tell that tag stripping does not always work as a defense. No result is given for closed models.

Insight: Attacks now copy the voice of the model

In October 2026, other researchers showed R2ECAP, an attack that puts poison in a chat window. A prompt injection detector found only 1% of its poisoned replies. The two attacks work on the reasoning trace, and this reads as a move to a layer that filters for user text do not check. Look for defenses that have tests for each model.