A fundamentally new methodology for attacking artificial intelligence systems was presented at the ICML 2026 conference in Seoul. Its essence lies not in compromising data or gaining unauthorized access, but in deliberately slowing down the model's operation to the point of complete unusability. Researchers from Zhejiang University and Alibaba demonstrated how the strength of reasoning AI can be turned into its Achilles' heel.
Attack Mechanics: How to Make AI "Think" Indefinitely
Unlike standard large language models (LLMs), reasoning models break down complex tasks into sequential logical steps. This feature makes them indispensable for multi-stage analysis, but simultaneously creates a vulnerability. When working with incomplete or contradictory data, such models tend to overthink, generating excessively long chains of reasoning.
The developed method uses a genetic algorithm to deliberately provoke this behavior. The algorithm shuffles task conditions, removes key premises, and adds extraneous ones, selecting those variants that trigger the longest possible response. The results are impressive: on the MATH test set, the length of reasoning chains increased by 26.1 times. The most vulnerable models turned out to be DeepSeek-R1, Qwen3-Thinking, GPT-o3, and Gemini 2.5 Flash.
Critically, queries created for one small model proved effective against other systems, including large commercial projects. This opens up the possibility of attacking closed services without significant costs.
Risks for DeFi and Agentic Systems
Of particular concern is the proliferation of reasoning models in agentic AI systems, including trading bots, smart contract audit tools, and decentralized infrastructure. In DeFi, AI-powered digital assistants manage real funds without human intervention. A deliberately induced logic failure creates a direct operational risk.
This work confirms the known problem of "overthinking," identified as early as February 2025. An analysis of 4,018 agent trajectories revealed three key patterns: "analysis paralysis" (the model continues reasoning instead of executing the task), "unpredictable actions" (attempting to perform multiple actions simultaneously after an error), and "premature termination" (stopping the task without verifying the result).
My expert assessment: This class of attacks represents not just an academic curiosity, but a real threat to infrastructure where response time is critical. Given that the further development of leading AI companies increasingly depends on the availability of computing power, such DoS attacks could become a cheap and effective tool for disrupting entire ecosystems. Investors and developers of DeFi projects should immediately reconsider their security protocols in the context of this new attack surface.