At the ICML 2026 conference in Seoul, researchers from Zhejiang University and Alibaba presented a fundamentally new class of attacks on reasoning AI models. Unlike traditional vectors aimed at data theft or control hijacking, this method renders the neural network useless by forcing it to waste enormous computational resources on processing requests.

Attack Mechanism: How to Make the Model "Think"

Reasoning models differ from regular LLMs in that they break down each task into sequential logical steps. This makes them indispensable for complex multi-stage analysis, but also opens up a vulnerability: when working with incomplete or contradictory data, such models tend to "overthink" — generating excessively long chains of reasoning.

The developed method uses a genetic algorithm to deliberately provoke this behavior. Researchers shuffle task conditions, remove key premises, and add extraneous ones, then select variants that trigger the longest possible response. The results are impressive: on the MATH benchmark, the length of reasoning chains increased by 26.1 times.

Key market models were affected: DeepSeek-R1, Qwen3-Thinking, GPT-o3, and Gemini 2.5 Flash. Notably, queries created for one small model proved effective against larger commercial systems. This means attacks can be prepared on cheap hardware and then applied against closed services.

One of the study's authors, Wei Cao, emphasized: "Our goal is not to demonstrate that large-scale attacks are possible with minimal cost, but to document that this attack surface exists."

Why This Is Critical for the Crypto Industry

Reasoning models are increasingly being integrated into DeFi agent AI systems: trading bots, smart contract audit tools, and decentralized infrastructure. AI-based digital assistants already manage real funds without human intervention. A deliberately induced logic failure is a direct operational risk.

Earlier, in February 2025, a group of researchers analyzed 4,018 agent trajectories and identified three patterns of overthinking:

  • analysis paralysis — the model continues reasoning instead of executing the task;
  • unpredictable actions — after an error, it attempts to perform multiple actions simultaneously;
  • premature termination — stops task execution without verifying the result.

The more pronounced the effect, the lower the performance. The new method makes these patterns controllable.

My expert assessment: The DeFi and agent AI systems market is on the verge of a serious challenge. While developers focus on functionality and speed, the security of reasoning architecture remains a "blind spot." Attacks like this could become a new DoS vector for crypto infrastructure, where request processing time directly translates into financial losses. Investors and developers should prioritize auditing the logical chains of AI agents.