Alibaba researchers find a DoS vulnerability in AI reasoning models

At ICML 2026 in Seoul in early July 2026, researchers from Zhejiang University and tech giant Alibaba presented a new type of attack on AI reasoning models: specially distorted prompts push DeepSeek-R1, OpenAI's GPT-o3 and Google's Gemini 2.5 Flash into endless reasoning loops, inflating response length many times over and creating a denial-of-service risk for commercial AI services.

How the attack works

Modern reasoning models do not answer instantly. They generate an internal monologue, working through the problem step by step before giving a final answer. The researchers turned exactly this feature into a vulnerability.

The team took 940 problems from three math benchmarks and used an LLM to break each one into logical premises and a final question. A genetic algorithm then applied "mutations": it swapped premises between problems, added unrelated conditions, removed key data without which the problem cannot be solved, and swapped final questions. After each round, the system selected the variants that inflated responses the most and triggered the most words signaling indecision: "but," "wait," "maybe," "alternatively." Five iterations later, the algorithm produces a set of prompts tailored to a specific model.

Key facts:

• Models tested: DeepSeek-R1, Qwen3-Thinking (Alibaba), GPT-o3 (OpenAI), Gemini 2.5 Flash (Google)
• Maximum increase in response length: 26.1× — DeepSeek-R1 on the MATH dataset
• Source dataset: 940 problems from three math benchmarks
• The attack works through a public API — access to model weights is not required
• Prompts created by a cheap auxiliary model also work against expensive closed systems

Why were reasoning models vulnerable?

Reasoning models are billed by token count: the longer the reasoning chain, the higher the load on servers and the more computing resources the provider spends on each request. If such an attack were run at industrial scale, legitimate users would see sharp slowdowns or complete unavailability of the service. The effect is not limited to math: the authors also tested programming tasks, scientific reasoning and dialogue scenarios, and recorded significantly longer responses in all cases.

"Our results show that overthinking is not an isolated phenomenon of particular models but a general vulnerability of modern reasoning systems," wrote

Wei Cao, a master's student at Zhejiang University, in a message to IEEE Spectrum.

An additional risk is that the attack transfers between models. Malicious prompts generated by a cheap open model work effectively against expensive closed systems, lowering the cost of an attack to a practically feasible level.

What this means

The vulnerability is systemic: it reproduces on all four tested reasoning models regardless of developer and architecture. The authors stress that the goal of the work is to establish that the vulnerability exists, not to build a ready-made DoS tool. Rate limiting, pricing policies and existing filters contain the threat but do not eliminate it. A systemic fix will require work at the architecture level: limiting the length of reasoning chains, detecting "empty loops" and filtering logically contradictory inputs.

Frequently asked questions

Which models were vulnerable to the attack?

The study tested four reasoning systems: DeepSeek-R1, Alibaba's Qwen3-Thinking, OpenAI's GPT-o3 and Google's Gemini 2.5 Flash. All four showed significantly longer responses on distorted prompts.

How real is the threat of an industrial DoS?

The authors acknowledge limitations: rate limiting, pricing and providers' existing filters reduce the practical effect. The study establishes that the vulnerability and the attack vector exist, but it does not demonstrate a ready-made tool with a guaranteed result.