The safety layer designed to keep AI agents from being hijacked can itself be turned into an attack surface.
Researchers have identified a class of denial-of-service attacks that target LLM-based guardrails — the reasoning models increasingly deployed to catch prompt injection and jailbreak attempts before they reach an agent. The attack works by injecting crafted natural-language payloads into data the guardrail processes, trapping its reasoning loop and forcing it to keep generating tokens. Two separate frameworks are described: one uses beam-search optimization guided by a strategy bank, the other exploits the guardrail's schema-following behavior through structural mutations with less compute overhead. In standalone tests, the attacks achieved 13 to 63 times token amplification across eight major models including Claude, GPT, Gemini, DeepSeek, and Qwen. In real-world deployments spanning web, desktop, code, and multi-agent systems, latency amplification reached 148 times.
The threat compounds because guardrails are often shared infrastructure, with one instance watching multiple agents simultaneously. Stall the guardrail with a single poisoned document and every co-located agent gets starved of compute — the whole system freezes without a single safety check actually being bypassed. That is a qualitatively different threat model than jailbreaking.
Payloads trained on one open-source surrogate transferred successfully to all eight commercial targets, which points to an architectural flaw rather than a model-specific one. That means no targeted patch is coming — guardrail designers will need to rethink cost-bounded reasoning from scratch for infrastructure that was never meant to be an attack target.