A small model as skeleton key: researchers decrypt the hidden reasoning of top AI models

What's happening

Modern AI models like Claude Opus, GPT-5.6 or Gemini 3.1 Pro "think" before they answer. Internally, they write out a long chain of intermediate steps, the so-called chain-of-thought, and only then produce the visible answer. The big providers no longer show this reasoning to their customers. They only send it as an encrypted block of text.

In a new paper titled "Stealing Reasoning Traces from Proprietary LLM APIs," a research team including Alexander Panfilov, David Schmotz, Ilia Shumailov, Luca Beurer-Kellner, Joachim Schaeffer, Ameya Prabhu, Jonas Geiping and Maksym Andriushchenko shows that this encryption can be bypassed with a simple trick. You pass the encrypted reasoning block from a strong model to a weaker, less well-protected model from the same provider and ask it to copy out the contents. According to the authors, this works at Anthropic, OpenAI and Google. The paper was published by Hacker Noon. The authors say the experiments reflect the state of things as of July 2026.

Why the reasoning is encrypted

Chains of thought are a sensitive matter for providers. They often contain far more than the final answer: intermediate hypotheses, tool call results, user data and secrets from the context. Competitors could use them for distillation, where you train your own smaller model on a large model's outputs and copy its capabilities that way. Exposed reasoning could also reveal how a model's safety mechanisms work, or contain harmful information.

That's why providers have scrapped plain-text reasoning. The API, the programming interface developers use to access the models, now returns at most a summary plus an encrypted block, in fields like signature or thinkingSignature. Providers don't want to store the reasoning themselves. So you as the customer have to send that block back with every follow-up request in the conversation, so the model can pick up where its earlier thinking left off. The principle is called stateless: the server remembers nothing, and the customer carries the memory around like a sealed envelope.

Technically, according to the paper, this is AEAD encryption (Authenticated Encryption with Associated Data). The contents aren't just made unreadable, they're also stamped with a tamper seal. Any manipulation gets detected and rejected. No provider has published details about its scheme so far.

The flaw: one key for everything

The researchers build on earlier work by security researcher Green, who showed that these blocks can be lifted out of their original conversation. The new team goes further: the providers apparently use a single global key for all reasoning blocks. The authors distinguish three levels of interchangeability:

• Within and across sessions: Blocks can be reused in a different order or in new conversations.
• Across users: A block generated by user A is also accepted when user B submits it.
• Across models: A block from Opus 4.8 also works with Haiku 4.5.

That last level is convenient for providers. Customers can switch to a cheaper model mid-conversation, or get rerouted automatically during overloads, without losing the reasoning work. According to the paper, compatibility looks like this (as of July 2026):

How the attack works

This is the core problem. Flagship models like Opus 4.8 or GPT-5.6 Sol are trained not to reveal their reasoning. Their small siblings, optimized for speed and low cost, often lack that defense, according to the researchers. The small model becomes a "decryption oracle": it receives the other model's reasoning block in its context window, its working memory for the current conversation, and is asked to copy it out word for word. A simple jailbreak is all it takes. That's an input that gets a model to ignore its own rules.

For decoders, the researchers used the weakest suitable model in each case: Claude Haiku 4.5, GPT-5.6 Luna and Gemini Robotics 1.6. With Haiku, a single fixed prompt was enough for every attempt. Haiku also supports "prefilling," where you write the beginning of the model's response yourself. GPT-5.6 Luna was more stubborn. The researchers needed several templates, repeated attempts (best-of-n sampling) and workarounds for anti-distillation protections. Among other things, they split the output into chunks of fewer than 50 tokens.

There's no direct way to check whether the decrypted texts really match the original reasoning. So the researchers take a detour. For billing purposes, the API reports exactly how many "reasoning tokens" a model generated. Tokens are the word fragments models compute with. On 120 Codeforces programming problems, the length of the extracted texts closely matched those counts for most inputs. The decrypted texts also contained far more detail than the official summaries, plus information like API tokens that didn't appear in the input at all.

Four attack vectors

1. Copying capabilities (distillation): Chains of thought are valuable training material. A student model learns not just the answer from them but also the path to it. The authors cite an earlier study in which even reconstructed chains of thought from GPT-5.4 mini raised the accuracy of a fine-tuned Qwen2.5-7B on the MATH500 math test from 68.4 to 76.0 percent. The new attack gets you the real reasoning. Decrypting 10,000 traces with 12,000 tokens of input and output each would cost about $720 at Haiku 4.5 prices. What's especially awkward for providers: if you pull the blocks from public datasets, you never have to query the expensive flagship model yourself. Monitoring systems on its interface never notice a thing. In a side experiment, the researchers fed the Kimi K3 model a short snippet of decrypted Opus 4.8 reasoning. Afterward, its answers closely resembled Claude's in style, sometimes almost word for word.

2. Jailbreak through the reasoning channel: Models are trained not to output harmful content. They're less restricted when thinking about it, because putting too much pressure on the chain of thought could make it harder to monitor. The researchers asked Opus 4.8 for three cars that are easy to steal and how to steal them. The visible answer stayed harmless, but the reasoning decrypted via Haiku contained information that could be misused, according to the paper.

3. Secrets from public logs: Developers often publish complete session logs of their AI agents, for benchmarks or on GitHub, for example. They scrub the readable text but can't check the encrypted blocks, because they can't decrypt them themselves. The researchers collected 315,320 reasoning blocks from public repositories and decrypted them. Inside, they found 367 personal data records and 182 credentials. Real user sessions alone yielded 62 API keys, 33 passwords and 30 private email addresses. In one example, GPT-5.2 Codex lists in its reasoning exactly the API keys that were supposed to be removed before a repository went public. In some cases, the data wasn't in the user's input at all but came from the model's memory.

4. Invisible prompt injection: Attackers can hide manipulated instructions inside encrypted blocks and slip them into public agent workflows. Since nobody can read the contents, the manipulation goes unnoticed.

Countermeasures

The researchers say they notified the providers in advance and propose cryptographic and system-level countermeasures. One obvious approach is already in the paper: providers could restrict decryption to the same conversation and the same model instead of using a global key. The published excerpt doesn't include the full details of the proposals. The source doesn't say whether or how the providers have since closed the gap. Either way, if you're a developer, treat reasoning blocks in logs like plain text. If you've published any, you should rotate any keys and passwords they might contain.

Our take

The paper shows a classic security problem: a convenience feature, seamless model switching, undermines the actual protection. The encryption itself isn't cracked. The weakest participant in the system simply holds the same key. That's doubly embarrassing for providers. They lose control over material they wanted to keep away from competitors, and their customers have unknowingly published secrets they couldn't even see.

There are limitations, too. The researchers show only indirectly, through token counts and plausibility, that the decrypted texts match the real reasoning, not through a direct comparison. The results describe the state of things in July 2026, and the providers have likely responded since. Still, the message is clear: encrypted chains of thought are no safe place for sensitive data as long as providers use one key for everything.