Research seriesL3offensive security
Extended-reasoning models think out loud, and it is tempting to trust that visible chain-of-thought as the real reason for an answer. This threat lab shows why that trust is unearned: the trace can be an unfaithful rationalization, an injection target, an exfiltration channel, and a timing side channel — all at once. Each exposure mode is taught by the assumption it breaks, the mechanism that makes it work, and the assumption-free control that does not trust the trace. Product-agnostic and grounded in the primary faithfulness and monitorability literature, tied back to the AI-agent stack every time.
A reasoning trace is a generated artifact, not a window into computation - and treating it as a trusted oversight signal is itself an attack surface.
Indirect prompt injection has a second, quieter target: the model's intermediate reasoning — and a steered scratchpad can be laundered through a clean-looking trace.
Once a reasoning trace leaves the model — to a log, a monitor, a user, or another agent — its surface form becomes an outbound channel an attacker or an optimizer can smuggle data through.
Even when the reasoning text is hidden, how much a model thinks — its token count and latency — is observable, and observable effort is a side channel.
A coherent defense for reasoning-capable systems starts from one assumption: the trace may be unfaithful, injected, a carrier, and a side channel — so trust nothing about it until it is tested.