Experts from Zhejiang University and Alibaba introduced a new class of attacks on AI systems at ICML 2026 in Seoul, as reported by IEEE Spectrum. Their goal is not to hack the model or access data, but to make it take so long to process requests that it becomes useless.

How the New Method Works

Reasoning models, unlike standard LLMs, break down tasks into sequential steps before providing answers. They are increasingly used in systems requiring complex multi-step analysis.

When dealing with incomplete or contradictory data, these models tend to overthink, generating excessively long chains of reasoning. This increases request processing time and computational resource consumption, creating a vector for DoS attacks in automated systems.

The researchers developed a method that intentionally provokes this behavior. A genetic algorithm shuffles task conditions, removes key premises, and adds unnecessary ones. It then selects options that elicit the longest responses.

On the MATH benchmark, the length of reasoning increased by 26.1 times. This method outperformed existing approaches. Vulnerable models included DeepSeek-R1, Qwen3-Thinking, GPT-o3, and Gemini 2.5 Flash.

The authors also found that queries designed for one small model were effective against other systems, including large commercial projects. This allows for attacks on closed services with minimal costs.

“Our goal is not to demonstrate that large-scale attacks are possible with minimal costs, but to highlight that this attack surface exists,” wrote researcher Wei Cao in a letter to IEEE Spectrum.

Why This Matters

Reasoning models are increasingly used in agent-based AI systems, including trading bots, smart contract auditing tools, and decentralized infrastructure.

In DeFi, AI-powered digital assistants manage real funds without human involvement. A logic failure—whether intentional or not—creates operational risk.

This new work builds on the already known tendency of reasoning models to overthink. In February 2025, a group of researchers analyzed 4,018 agent trajectories and identified recurring patterns of overthinking in models:

  • analysis paralysis — the model continues reasoning instead of completing the task;
  • unpredictable actions — after an error, it attempts to perform multiple actions simultaneously;
  • premature termination — it stops task execution without verifying the result.

Reasoning models were found to be more prone to overthinking. The more pronounced the effect, the lower the effectiveness.

As a reminder, at the beginning of July 2026, analysts warned that the further development of OpenAI and Anthropic increasingly depends on the availability of computational power, funding for data centers, and regulatory decisions.