Forged reasoning tags changed model disclosure and agent tool actions

A controlled study tested fake reasoning markers in direct secret disclosure and in malicious text embedded in agent-read documents.

Entry and authority. Attackers could submit messages or alter a document that the agent was legitimately reading; simulated private financial records and effect checkpoints were in the evaluation.

Observed mechanism and consequence. Constructed reasoning-style strings were evaluated for their ability to shift a model from authorized summarization into unapproved disclosure or tool actions.

Limits and status. The tested data and execution environment were controlled; no customer breach or universal effectiveness rate is implied.

The thought-injection study used strings imitating model reasoning to change behavior in two separate settings: disclosure of synthetic records placed in high-trust context and tool use after reading a manipulated document. Its controlled results varied substantially by model and whether the injected material resembled that model's own reasoning format. The test does not show a universal exploit of private reasoning channels in commercial products.

Measured outcomes. Study 1 used 150 synthetic financial customer records placed in protected context, 25 attack vectors with variations across three models and tags, yielding 629 disclosure runs out of 6,000. Among those 629, 67.7% leaked only in final answers, 20.8% only in reasoning and 11.4% in both, which is a distribution of already-leaking runs, not a separate success rate. Study 2 placed attacker-authored text in a document the agent had a legitimate reason to summarize. In 50 runs per condition, MiniMax-M2.5 acting on forged own-voice reasoning with tags reached a controlled listener and exposed synthetic secrets in 42%, or pushed a modified backdoor to a test Git repository in 50%; untagged versions fell to 8% and 10%, while ordinary user-style malicious instructions scored zero in these tested cells. The tests do not establish equivalent behavior across all deployed reasoning models or actual stolen financial records.

The first experiment tested whether fabricated reasoning tags could elicit records placed in a synthetic system message. The second changed the attacker-controlled surface: a document the defender was legitimately summarizing carried prose styled as the model's own internal reasoning. The second experiment measured downstream tool effects, not just whether a response reproduced hostile instructions.

These results isolate a practical trust error. A tag or apparent thought is still source material when it comes from a user document. Stripping visible thinking markers alone is not a complete control because the paper found model-specific behavior and some effective untagged payloads. A host-side check must bind each outbound connection, repository push or secret read to the original authorized task and current principal. Neither the 629/6,000 disclosure measurement nor the 50% Git result is a production incident rate.