Reasoning models can talk themselves into an unsafe answer in the space of a single word.
Researchers studied where the safety training in large reasoning models actually breaks down when facing harmful requests, and traced the failure to one moment: the first token the model generates. They call this Onset Refusal Collapse - the internal signal that should trigger a refusal sharply drops right as the model starts answering, and once it is gone, the rest of the response tends to follow the unsafe path. Their fix, called SafeToken, inserts a trained "safety anchor" into the model's process at that exact instant, adjusting only a single token embedding. On benchmarks built around harmful queries, it restored much of the lost safety without noticeably hurting the model's reasoning ability.
The finding reframes AI safety failures as a timing problem rather than a missing-guardrail one. These models often seem to register that a request is dangerous, then lose that signal in the split second they start generating a reply. If that holds up broadly, safer models might not require the months of retraining and preference tuning labs currently lean on - just a better-placed nudge at the right moment.
Still, a patch for one failure mode is not the same as a fix for the underlying behavior. Anyone who has watched jailbreak techniques evolve knows models tend to find a new opening once the old one closes.