Researchers extract AI models' hidden reasoning across three major labs' APIs

A paper from researchers including Alexander Panfilov, Ilia Shumailov and Maksym Andriushchenko described a vulnerability in how leading AI providers protect models’ internal chain-of-thought reasoning. OpenAI, Anthropic and Google DeepMind do not store this reasoning server-side; instead they return it to the client as encrypted text, which is passed back with each follow-up request. The researchers found these encrypted blocks were interchangeable across different sessions, users and models within a single provider’s ecosystem — meaning a block generated by one model could be replayed to another.

Exploiting that, the authors showed they could inject an encrypted reasoning trace produced by a capable model into a weaker, less-guarded model from the same provider and force it to decode and output the trace verbatim in plaintext, without ever jailbreaking the stronger model directly. They described four resulting attack vectors: circumventing anti-distillation protections meant to stop rivals extracting a model’s reasoning; recovering private data from reasoning blocks that developers had unknowingly shared in public session logs; surfacing hazardous information contained in a model’s internal reasoning even when its visible final answer safely declined a request; and hiding prompt-injection payloads inside encrypted blocks to poison public agent logs. Scraping 315,320 reasoning blocks from public repositories, the authors said they recovered 367 pieces of personally identifiable information and 182 credentials.

The researchers said they followed responsible disclosure before publishing and proposed cryptographic and system-level mitigations; by the time the paper appeared, the specific attacks described were reported as no longer reproducible against the affected providers’ current systems. Separate online speculation linked the vulnerability to reports that the Chinese lab Moonshot AI’s Kimi K3 model had distilled frontier labs’ reasoning traces; that connection is not part of the paper’s own findings, and this entry does not corroborate it.

The work adds to a growing body of security research treating chain-of-thought — often marketed as a transparency and safety feature — as itself a new attack surface, alongside the computer-use and tool-agent exploits published the same week.