Reasoning models
The same loop, run longer. The trace it leaves is an output, an input and a bill.
“Reasoning model”, “thinking mode”, “extended thinking”. The names suggest a different kind of machine. It is the same next-token loop from module 0.1, allowed to run for a while before it commits to an answer. Everything useful and everything dangerous about these models follows from that one change.
Same loop, just more of it
A plain model reads the prompt and starts emitting the answer. A reasoning model first emits a stretch of intermediate text, then the answer. That intermediate text comes out of the identical mechanism you drove in 0.1: one token at a time, sampled from a distribution.
The mechanism is the same. The behaviour is trained, so this is more than the old model left running: these models are taught to spend the extra tokens usefully. For everything in this course the mechanism is what matters, because it is what decides where that text can end up.
In 0.1 you assembled a context window from sources. The reasoning trace is one more source in that window, with an unusual property.
The trace is content the model wrote into its own context. You did not put it there and the user did not type it, but everything after it is conditioned on it.
Drag the budget to see how big that stretch gets, and who pays for it.
Where the reasoning tokens go
3,520 tokens totalThe user sees
320
tokens. The answer only. The thinking is generated, used, and never shown.
You are billed for
2,320
output tokens, 7.3× what the user saw. ~$348/day at 10,000 requests.
Attack surface
2,000
tokens nobody reviews, readable by whoever gets the trace, and billable by whoever can trigger it.
Two things usually surprise people. The user sees a fraction of what was generated, so the visible answer is a poor guide to what the system did. And you are billed for all of it, which makes “how long should it think?” a cost question as well as a quality one.
Three consequences, all mechanical
None of these need the model to misbehave. They follow from the trace being tokens in a context window.
| Because the trace is… | It becomes… | Covered in |
|---|---|---|
| something the model wrote | An output. OWASP lists reasoning traces alongside tool-call arguments as disclosure surfaces, and asks you to "classify and redact reasoning traces as first-class output". The model may reason over context the answer withheld. | 2.10 |
| text back in the context | An input. OWASP's LLM01 delivery-surface list names "intermediate reasoning" outright, next to retrieved content and tool output. Text re-entering the window is a delivery surface whoever produced it. | 2.7 |
| billed output tokens | A cost lever. Anyone who can make the agent think harder can make it cost more, without violating any policy. | 4.7 |
What to carry forward
There is no “reasoning security” track in this course. Reasoning models are the same architecture with a longer middle, so they inherit every risk in the curriculum and add one surface of their own: a trace that is an output worth redacting, an input worth filtering, and a bill worth capping. Three questions to ask of any system that uses one.
That is the introduction. Next is Track 01, where the flat context window from 0.1 becomes the central security claim of the field.
Sources
- T1OWASP Top 10 for LLM Applications 2026 · LLM01:2026 lists "intermediate reasoning" among delivery surfaces; LLM02:2026 lists reasoning traces among disclosure surfaces, says to "treat reasoning traces and tool arguments as outputs, not debugging leftovers", and mitigates with "classify and redact reasoning traces as first-class output. Never log raw traces to unrestricted observability." The by-default logging point is from the DSGAI14 crosswalk entry
- T1Zhao, Fu, Schaeffer, Sharma & Barez · Chain-of-Thought Hijacking (arXiv 2510.26418). Refusal dilution, and the finding that over-extended reasoning weakens refusal behaviour