Imagine you're a stage magician. You can't force an audience member to think of a specific card — but if you pre-deal the top card of the deck before they "choose," every subsequent shuffle is conditioned on that plant. That's output-prefix injection: you don't hack the model's weights or training data; you just slip a few tokens at the start of its response, and every token the model generates afterward follows from your planted seed. This paper asks what happens when that planted seed is placed inside the reasoning scratchpad — the chain-of-thought "thinking" step that reasoning LLMs now expose via API. The committed claim: injecting malicious text into the reasoning channel alone is essentially inert (~0% attack success), but combining that same reasoning injection with a trivial output prefix rockets attack success to as high as 99% on some frontier models. This is the first controlled factorial study that isolates the scratchpad as an attack surface and compares it against output-prefix-only and combined attacks across both exposed- and hidden-reasoning model APIs. The experimental design is clean and legible. Three prefix types crossed with two reasoning-injection conditions yield six cells, tested across 1,800 cases drawn from AdvBench — a standard adversarial benchmark — on three 2026-era frontier models: Gemini 3 Flash Preview, DeepSeek V4 Flash, and Claude Haiku 4.5. The key finding is an interaction effect: reasoning injection without output prefix ≈ 0% success; output prefix alone is moderate; the combination is devastating. Contextual prefixes (tailored to the query) outperform static ones, and susceptibility varies by model, which suggests alignment tuning catches some vectors but not the combined pathway. What makes this matter architecturally: reasoning models introduced the scratchpad as an intermediate step to improve answer quality. Some API providers expose this channel — users or upstream systems can write into it. The paper shows that this exposed channel isn't dangerous by itself (the model's final-answer safety filters still catch malicious reasoning), but it becomes a force multiplier when combined with the already-known output-prefix vector. The safety filters appear to key on the beginning of the assistant's final response; if that response already starts with compliant-looking text, the model continues compliantly. On the integrity front, the study uses AdvBench, a community-standard jailbreak benchmark, which is a strength. The factorial design with 1,800 cases is unusually disciplined for a red-teaming paper. The weakness is that only three models are tested, all via API black-box access, so we can't see whether the vulnerability is architectural (inherent to exposed scratchpads) or an artifact of specific API implementations. No code release is mentioned, and no independent replication exists yet. The milestone question is sharp: API providers now face a concrete engineering decision — should the reasoning channel be writable at all? The paper essentially says: if you expose it, you've created a jailbreak amplifier. The next number to watch is whether providers close this channel or add separate safety checks on the reasoning prefix. DeepSeek and Google have the most exposed APIs; Anthropic's hidden-reasoning approach appears more resilient but wasn't immune in the combined condition. The obvious next experiment not run: testing on models with hidden reasoning channels where the attacker cannot directly write into the scratchpad but might influence it indirectly through prompt engineering. The authors tested Claude Haiku 4.5 (hidden reasoning) but only via the direct injection path. Indirect influence — crafting prompts that steer the model's own chain-of-thought toward malicious reasoning — is the natural successor and almost certainly harder to pull off. Honest read: they're scoping the paper tightly to the direct-injection threat model, which is the right call for a first controlled study, but it leaves the more realistic attack scenario for future work.
