At the ICML 2026 conference in Seoul, a group of researchers from Zhejiang University and Alibaba introduced a fundamentally new type of attack on artificial intelligence systems. Unlike traditional methods aimed at stealing data or hacking a model, this attack aims to make AI useless by forcing it to process requests indefinitely.
Attack Mechanism: How to Make AI "Overheat"
Reasoning models, unlike conventional LLMs, break down complex tasks into sequential steps, making them ideal for multi-stage analysis. However, when working with incomplete or contradictory data, these models tend to "overthink"—generating extremely long chains of reasoning.
The researchers developed a method using a genetic algorithm to deliberately provoke this behavior. The algorithm shuffles task conditions, removes key premises, and adds extraneous data, selecting variants that trigger the longest possible response. On the MATH benchmark, reasoning length increased by 26.1 times, significantly surpassing existing methods of such influence.
Models such as DeepSeek-R1, Qwen3-Thinking, GPT-o3, and Gemini 2.5 Flash proved vulnerable. Notably, queries crafted for one small model were effective against other systems, including large commercial projects. This opens the door for attacks on closed services with minimal costs.
"Our goal is not to demonstrate that large-scale attacks are possible with minimal costs, but to document that this attack surface exists," noted one of the researchers, Wei Cao.
Why This Is Critical for the Crypto Industry
Reasoning models are increasingly being integrated into agentic AI systems, including trading bots, smart contract audit tools, and decentralized infrastructure. In DeFi, AI-powered digital assistants manage real funds without human intervention. A deliberately induced logic failure creates a direct operational risk.
This work builds on a known characteristic of reasoning models—their tendency to overthink. In February 2025, a group of researchers analyzed 4,018 agent trajectories and identified recurring patterns:
- Analysis paralysis — the model continues reasoning instead of executing the task.
- Unpredictable actions — after an error, it attempts to perform multiple actions simultaneously.
- Premature termination — stops task execution without verifying the result.
Reasoning models proved more prone to overthinking, and the stronger this effect, the lower the performance.
My expertise: This is not just an academic finding. For DeFi protocols, where every second of delay can cost millions, such attacks are a direct threat. The vulnerability of reasoning models to logical traps calls into question their use in high-frequency trading and automated asset management. Investors and developers should reconsider the architecture of agentic systems, implementing mechanisms for forced timeouts and data validation.