Preprint demonstrates chat-based poisoning of reused AI reasoning caches

Researchers report a chat-based attack that poisons stored reasoning reused by language models, achieving a 46% attack success rate in a reasoning-trace retrieval system. Their preprint describes R²ECAP, which requires only access to a system's chat interface. The attack creates two reasoning traces. The first steers the model toward an adversarial target; the second retains that influence in cached internal data even after the first trace and its cache entries are discarded. Tests covered three open-weight models and three datasets, with attack success reaching up to 79%. A popular prompt injection detector flagged only 1% of retained responses. The findings concern systems that reuse reasoning caches.