New Research Reveals AI Reasoning Models Like GPT-5 and Claude Opus Vulnerable to 'Overthinking' Attacks

AI Reasoning Models Face New Denial-of-Service Threat

New research presented at the International Conference on Machine Learning (ICML) 2026 by researchers from Zhejiang University and Alibaba has uncovered a significant vulnerability in advanced AI reasoning models. The study details a method called "Inducing Overthink," which can weaponize these models into denial-of-service attacks by forcing them into pathological, excessively long internal reasoning chains. This vulnerability affects leading AI systems, including GPT-5 and Claude Opus, highlighting a new security surface in the rapidly evolving field of artificial intelligence. For broader context, explore our AI News.

Understanding the 'Inducing Overthink' Attack

The "Inducing Overthink" method leverages a hierarchical genetic algorithm to create logically perturbed prompts. These specially crafted prompts are designed to manipulate reasoning models, causing them to generate internal reasoning chains that are significantly longer and more redundant than typical operations. On the MATH benchmark, for instance, these chains were observed to be up to 26.1 times longer than normal.

A critical aspect of this attack is its black-box nature. This means it operates effectively without requiring access to the internal workings or architecture of the target model. Furthermore, the research demonstrates that the attack successfully transfers from smaller proxy models to large commercial language reasoning models (LRMs) developed by major providers such as OpenAI, Anthropic, and Google. This broad applicability underscores the widespread potential impact of the vulnerability.

Impact on Leading AI Systems: GPT-5 and Claude Opus

The findings specifically highlight that this vulnerability affects the core reasoning paradigm underpinning some of today's most capable AI systems. Among those explicitly mentioned are GPT-5, developed by OpenAI, and Claude Opus, from Anthropic. These models, known for their advanced reasoning capabilities, could be susceptible to attacks that exploit their very strength.

The inflated reasoning processes triggered by these attacks consume substantial computational resources and energy. This could lead to several practical consequences for model providers and users, including the exhaustion of API rate limits and significant increases in infrastructure budgets due to unexpected compute demands. The ability to induce such pathological overthinking presents a potent and potentially low-cost attack vector for malicious actors.

Feature Matrix: Vulnerability to 'Inducing Overthink'

AI Model	Vulnerability to 'Inducing Overthink'
GPT-5	Yes
Claude Opus	Yes

Implications for AI Security and Development

This research exposes a fundamental security challenge in the design of current AI reasoning models. The introduction of sophisticated reasoning capabilities, while enhancing model performance, also creates new and largely unexplored security surfaces. The "Inducing Overthink" attack demonstrates that these surfaces can be exploited to disrupt service and incur significant operational costs.

In response to this vulnerability, model providers may need to implement several mitigation strategies. These could include setting explicit reasoning-depth limits to prevent excessive computation, developing anomaly detection systems to identify unusual prompt structures, or imposing per-request compute caps to manage resource consumption. Addressing these issues will be crucial for ensuring the stability and security of advanced AI services.

Conclusion

The ICML 2026 research from Zhejiang University and Alibaba reveals a critical vulnerability in AI reasoning models, including prominent systems like GPT-5 and Claude Opus. The "Inducing Overthink" method demonstrates how logically perturbed prompts can force models into resource-intensive, pathological reasoning, posing a significant denial-of-service threat. This discovery necessitates a re-evaluation of security protocols for advanced AI, potentially leading to the implementation of reasoning-depth limits and enhanced anomaly detection by model providers to safeguard against such attacks.

Sources

• GitHub - aim-uofa/Active-o3: [ICML2026] ACTIVE-O3: Empowering Multimodal Large Language Models with Active Perception via GRPO · GitHub
• SuDIS Group at Zhejiang University · GitHub
• GitHub - microsoft/World-R1: [ICML 2026] World-R1: Reinforcing 3D Constraints for Text-to-Video Generation · GitHub
• https://spectrum.ieee.org/ai-reasoning-models-security-risk
• https://icml.cc/virtual/2026/poster/62234