Researchers from Zhejiang University and Alibaba presented a new method for destabilizing AI systems at the ICML 2026 conference in Seoul. Unlike traditional attacks aimed at data theft or output substitution, this approach targets model paralysis by forcing a "loop" in its logical chains.
Essence of the method: genetic algorithm against reasoning models
Modern reasoning models, unlike conventional LLMs, break down complex queries into sequential steps. This makes them indispensable in agent systems — from trading bots to smart contract auditing. However, this very architecture opens up a vulnerability: when working with incomplete or contradictory data, models tend to overthink, generating excessively long reasoning chains.
The developed method uses a genetic algorithm to distort input conditions: it shuffles premises, removes key data, and adds redundant information. The algorithm then selects those variants that provoke the longest response. On the MATH benchmark, reasoning length increased by 26.1 times, significantly surpassing the performance of existing attacks.
The most vulnerable models turned out to be DeepSeek-R1, Qwen3-Thinking, GPT-o3, and Gemini 2.5 Flash. Key finding: queries created for one small model work effectively against others, including large commercial systems. This opens up the possibility of attacking closed services without significant computational costs.
Risks for DeFi and agent systems
Reasoning models are increasingly being integrated into DeFi infrastructure, where digital assistants manage real funds without human intervention. A deliberately induced logic failure creates a direct operational risk. Particularly alarming is that the attack does not require hacking — it is enough to send a specially crafted query that will cause system paralysis.
The researchers emphasize that their work does not demonstrate "large-scale attacks with minimal costs" but rather identifies the existence of a new attack surface. Previously, in February 2025, an analysis of 4018 agent trajectories revealed three patterns of overthinking: analysis paralysis (the model continues reasoning instead of completing the task), unpredictable actions (attempting to perform multiple actions simultaneously after an error), and premature termination (ending the task without verifying the result).
Expert opinion: This method is a warning sign for the industry. If reasoning models become the standard for DeFi agents, such attacks could lead to real financial losses. Developers need to implement mechanisms for detecting abnormally long reasoning chains and limit query execution time. Otherwise, we risk encountering "infinite" transactions blocked by AI logic.