Researchers Steal Encrypted Reasoning Traces from Claude, GPT, Gemini APIs
A new paper demonstrates a method to extract hidden chain-of-thought reasoning from proprietary LLM APIs by replaying encrypted reasoning blocks into weaker sibling models from the same provider, which then output the traces in plaintext. The researchers verified their extracted token counts match billed API thinking tokens 1:1 for most prompts, suggesting near-complete coverage of hidden reasoning. The vulnerability affects Anthropic, OpenAI, and Google models, with cross-model compatibility allowing traces to be replayed across sessions, users, and models.
Coverage timeline
Hacker Newsquantumgarbage
Techmeme
Will Knight / Wired : Researchers find that feeding a frontier model's encrypted reasoning traces to a weaker model from the same provider can make it output the traces in plaintext — Researchers devised a way to extract “reasoning traces” from Claude, GPT, and Gemini. What they found, they say …
Hacker Newshimata4113
# Can Bölük on X: "guys you do know you can just disable thinking, and instead give it a "deep_think" tool, and it will call it with internal CoT reasoning format right? gl fixing that https://t.co/eWnPGbwxXs" * Can Bölük @_can1357 guys you do know you can just disable thinking, and instead give it a "deep_think" tool, and it will call it with internal CoT reasoning format right? gl fixing that Alexander Panfilov @kotekjedi_ml 18h We can finally talk about it: We found a way to extract hidden reasoning of frontier models using a vulnerability in the APIs of every frontier AI company. We verified that our reasoning token count matches billed API thinking tokens 1:1 for most of the prompts we queried. 5:23 PM · Aug 11, 2026574.9K Views 122 330 4.8K 3K * Can Bölük @_can1357 12h Here's a PoC pasta.can.ac/omegiligox.py Note how I said nothing about the format of the argument and we get gpt55+'s grug-talk format. Beyond this, which is kinda funny. 3 6 381 49K Can Bölük @_can1357 11h kinda mi
Simon Willison
Stealing Reasoning Traces from Proprietary LLM APIs A vanity domain name ( stolen-thoughts.com ) for a neat paper : Anthropic, OpenAI, and Google return encrypted chain-of-thought blocks to clients that can be replayed across sessions, users, and models. We take a trace produced by a frontier model, replay it into a weaker sibling, jailbreak the weaker model, and recover the stronger model’s hidden reasoning in plaintext You can see an example of these encrypted blocks by running: curl https://api.openai.com/v1/responses \ -H " Content-Type: application/json " \ -H " Authorization: Bearer $( llm keys get openai ) " \ -d ' { "model": "gpt-5.6-luna", "input": "Solve step by step: What is the smallest positive integer divisible by every integer from 1 through 20?", "reasoning": { "effort": "medium" }, "include": ["reasoning.encrypted_content"], "store": false, "stream": false } ' Here's the full output , which includes chunks that look like this: "output": [ { "id": "rs_0a7479de7ebae17001
机器之心机器之心
「这是今年最好的安全论文，帮 Anthropic、OpenAI、Google 修了个价值十亿美元的大 bug。」 今天，一篇关于前沿大模型安全漏洞的论文，在社交媒体上引发轩然大波。 短短 19 个小时，已吸引 220 万人围观、讨论。 该论文的核心主张是， 各大前沿模型 API 存在设计缺陷，原本被加密隐藏的完整思维链，可以被完整地提取出来 。 由于他们拿不到服务器中的原始明文，无法逐字核对，只能用 API 账单记录的「思考 Token 数」进行长度验证。 在他们测试的大多数提示词中，提取出的推理 Token 数与 API 计费记录中的思考 Token 数基本呈 1:1 对应。 这说明， 提取结果很可能覆盖了大部分隐藏推理 。 论文标题：Stealing Reasoning Traces from Proprietary LLM APIs 论文地址：https://arxiv.org/pdf/2608.09867 过去一年，大模型厂商认真藏起模型的「思考过程」。 这是因为完整思维链记录了模型如何拆解问题、尝试方案、发现错误再修正。对竞争对手来说，这些数据的价值远高于一个最终答案；对模型厂商来说，它也可能暴露安全策略、用户隐私甚至 API Key。 于是，OpenAI、Anthropic、Google 等主要厂商都开始把完整推理过程藏起来。取而代之的是以一种用户无法直接读取的加密文本块形式返回给客户端。 为了在多轮对话中保持上下文连续性，同时避免在服务器端存储全部推理状态所带来的开销，客户端需要在之后的每次 API 请求中，把这段加密后的推理块重新传回模型服务商。 这样的无状态架构虽然解决了存储问题，却也引入了一个关键漏洞： 这些加密块在同一家模型提供商的生态内部，可以跨不同会话、不同用户，甚至不同模型完全兼容并相互替换。 加密推理的跨模型兼容性（截至 2026 年 7 月）。表格的行代表生成加密推理块的源模型，列代表接收注入推理块的目标模型。✓ 表示在这一模型组合中，目标模型能够读取并处理被注入的推理内容。Claude：除 Fable 5 生成的推理外，其他模型的推理轨迹均可由任意同系列模型重放。GPT：GPT-5.6 系列可以重放此前所有代际模型生成的推理轨迹。Gemini：任意模型生成的推理轨迹都可以注入并重放到其他模型中。 也就是说 想偷走最强模型的隐藏思维链
