Reasoning-channel prefill plus a two-word output prefix jailbreaks three production models at up to 99%.

Across 1,800 AdvBench cases, injecting malicious reasoning alone was inert at about 0% success. Pairing it with a short output prefix pushed attack success as high as 99% on Gemini 3 Flash, DeepSeek V4 Flash and Claude Haiku 4.5, and contextual prefixes beat static ones. (arXiv 2609.29775) The attack needs an API that lets callers edit the reasoning scratchpad or prefill the response. Any agent platform that passes prefill or thinking-block editing through from untrusted callers is exposing an injection channel most threat models don't list.