OpenAI o1/o3 reasoning chain jailbreak via chain-of-thought manipulation
Date: 2025-01
Affected: OpenAI o1, o1-mini, o3-mini reasoning models — attack class is specific to CoT reasoning models; applicable to any model with extended reasoning capabilities
Attack vector: adversarial-input
Category: research-demonstrated
Severity: High

Multiple researchers independently demonstrated that OpenAI's o1 and o3 reasoning models — which use extended chain-of-thought (CoT) processing — are susceptible to jailbreaks that exploit the reasoning chain itself. By embedding adversarial instructions that interact with the model's internal reasoning steps, attackers can cause the model to "reason its way" into compliance with harmful requests. The attack exploits the fact that safety training operates on the final output but the CoT steps can establish logical premises that make harmful conclusions appear well-reasoned. OpenAI acknowledged the attack class and noted that reasoning models present novel safety challenges distinct from standard instruction-following models.

Impact: Novel jailbreak class specific to reasoning models; safety training on final output is insufficient when CoT steps can establish adversarial premises; challenges the assumption that more capable reasoning improves safety

Mitigations:
Safety evaluation must cover reasoning chain content, not just final output
CoT monitoring: flag reasoning steps that establish premises for harmful conclusions
Reasoning chain length limits for untrusted inputs
Independent safety classifier on CoT steps before final output generation

Architectural layers (MAESTRO):
label: Foundation Models
notes: Reasoning mechanism exploited — CoT safety alignment gap
role: origin
label: Evaluation & Observability
notes: CoT monitoring insufficient — safety evaluation operates on final output not reasoning steps
role: blind-spot
label: Deployment & Infrastructure
notes: No deployment-layer intervention on reasoning chain content
role: blind-spot