Poisoned Documents Can Freeze AI Agent Guardrails Dead in Their Tracks
Researchers found that a single malicious input can trap reasoning-based safety systems in extended thinking loops, slowing LangGraph deployments by 148x and starving co-located agents of resources.
The failure mode here is an elegant one: the security layer becomes the attack surface.
Researchers from Hong Kong University of Science and Technology have documented a class of attack they call reasoning-extension denial-of-service. Rather than bypassing a guardrail or jailbreaking a model, the technique forces the reasoning-based safety check itself into an extended deliberation loop. One poisoned document. Entire shared guardrail infrastructure saturated.
Four AI agent frameworks were tested — LangGraph, BrowserGym, OpenHands, and OSWorld. LangGraph recorded a 148x processing slowdown. BrowserGym hit 131x. OpenHands came in at 36.3x, OSWorld at 18x. These are not edge-case numbers you can dismiss in a risk register.
What makes this uncomfortable is the transferability. Prompts engineered against one open-source model worked across eight different LLM families. An attacker does not need insider knowledge of your specific proprietary stack. In practice, that wipes out a lot of the obscurity-as-defense assumptions organizations quietly rely on.
The deeper problem is architectural. Organizations centralizing AI governance by routing multiple agents through shared safety infrastructure are building concentration risk into the control plane. A guardrail DoS does not need to exfiltrate anything or escalate privileges. It just needs the system to be unusable when it matters — during automated claims processing, real-time fraud detection, or AI-assisted incident response.
The mitigations available right now are unsatisfying. Strict token limits push deployments toward fail-open or fail-closed behavior rather than solving the problem. Smaller reasoning budgets cut latency but weaken security decisions. Larger reasoning models can actually amplify the attack by spending more cycles following the injected reasoning structure. The stronger the guardrail reasons, the longer it reasons — and that property becomes a liability.
Conventional prompt injection filters were also found susceptible. So the existing toolbox is partial at best.
One thing the post-mortem will say is that nobody treated the AI governance layer as critical infrastructure until something broke. The same rigor applied to API gateways and identity services needs to reach AI control planes. That means decoupling guardrail infrastructure from agent compute, implementing asynchronous or tiered safety checks, and actually red-teaming the safety stack for availability failures — not just harmful outputs.
If your threat model for agentic AI only covers what the model might say, you are missing what the security layer might do to your uptime.
