The Safety Paradox: How LLM Defenses Become Their Own Attack Surface

Researchers have discovered a critical vulnerability in reasoning-based LLM guardrails, where the safety mechanism itself becomes the attack target. This reasoning-extension DoS requires no model access or system prompt knowledge—only the ability to place text in the agent's path—yet all existing mitigation strategies fail, making this a structural problem rather than a patchable flaw. The implications are severe for shared infrastructure: a single crafted payload can stretch a guardrail call to over 730 seconds, potentially paralyzing co-located agents.