Oct 16, 2026
Study finds that with thinking on, part of an agent's decision to follow a prompt injection forms while it reasons
Researchers from Fullive-AI, Peking University, JD.com and other institutions replay AgentDojo episodes up to the step where an agent reads an injected tool output, then resample the rest many times to separate what is fixed at read time from what is decided afterwards. They report that a Qwen3-8B agent without thinking is largely decided at read time, while with thinking part of the decision forms during reasoning. Zero-shot chain-of-thought monitors on cheaper models miss much of what is already decided, while stronger monitors and a lookahead monitor that judges simulated next actions come close to the measured ceiling.