OTora: A Unified Red Teaming Framework for Reasoning-Level Denial-of-Service in LLM Agents

Large Language Models (LLMs) are increasingly deployed as autonomous agents that execute tool-augmented, multi-step tasks, where latency is a critical factor for real-world applications. Yet an overlooked threat is Reasoning-Level Denial-of-Service (R-DoS), in which an attacker preserves task correctness but degrades availability by inflating an agent’s reasoning depth or tool-use budget. We introduce OTora, the first unified, two-stage red-teaming framework for instantiating R-DoS attacks. Stage I optimizes an adversarial trigger that induces targeted tool invocations using insertion-aware scoring and dynamic target co-evolution, supporting both black-box and white-box settings. Stage II generates agent-aware reasoning payloads via an ICL-guided genetic search that amplifies overthinking while maintaining correct task outcomes. Across WebShop, Email, and OS agents built on multiple backbone models such as LLaMA-70B and GPT-OSS-120B, OTora achieves up to 10× increases in reasoning tokens and order-of-magnitude latency slowdowns, all while preserving near-baseline task accuracy. Finally, we discuss mitigation strategies for detecting and constraining abnormal reasoning and latency spikes.

Large language models (LLMs) are increasingly deployed as autonomous "agents" that browse websites, send emails, and run programs on your behalf. For these agents to be useful, they must complete tasks quickly enough. A shopping agent that takes several minutes to add an item to a cart is effectively broken, even if the final answer is correct. We discovered a new way to attack such agents, which we call Reasoning-Level Denial-of-Service (R-DoS). Instead of tricking the agent into doing something wrong, an attacker plants benign-looking content (such as a math puzzle on a webpage) that lures the agent into "overthinking", burning large amounts of computation on the puzzle while still completing the original task correctly. Our framework, OTora, makes this attack reliable across different agents and language models. Across realistic shopping, email, and operating-system agents, OTora slows agents down by up to 10× without affecting their final task accuracy. This reveals that "responding correctly" isn't enough. Agents also need defenses against being made slow on purpose, especially as they take on time-sensitive tasks.