Comment by jampekka

"Thinking" is just normal model output that's hidden from user. In practice it's just stuff in a <reasoning> tag or similar that gets filtered out from the user view. And thus it suffers from the same injection problems where the model fails to properly take into account what was the "source" of which block of tokens.