Bottom line: Researchers managed to extract encrypted chain-of-thought blocks from OpenAI, Anthropic and Google models by replaying traces into weaker models of the same family and jailbreaking them; the providers have since closed the gap.
A new study shows that encrypted chain-of-thought blocks from proprietary LLM APIs were reusable across sessions, users and models. By replaying the traces into weaker sibling models and jailbreaking those, researchers were able to reconstruct the hidden reasoning processes of the stronger models in plaintext.
The study, published under the domain stolen-thoughts.com, demonstrates that Anthropic, OpenAI and Google return encrypted chain-of-thought blocks (“encrypted_content”) to clients. These blocks can be retrieved via the API, for example via the OpenAI Responses API using the parameter “include”: [“reasoning.encrypted_content”]. The researchers found that all models within a model family used the same encryption key. As a result, a reasoning trace generated by a frontier model could be replayed into a weaker model of the same family. After jailbreaking that weaker model, the systems output the previously encrypted reasoning content in plaintext. According to the study, the attack was easiest to carry out on Claude Haiku 4.5, among other methods via a prompt instructing the model to repeat its reasoning content verbatim within a defined tag, combined with an assistant-turn prefix — a feature that was removed in the 4.6 models but still worked in Haiku 4.5.
For CISOs, the relevant point is that proprietary reasoning models were previously considered a black box with protected internal thought processes. The study shows that this protective assumption did not consistently hold: raw reasoning tokens, which according to the authors were never intended for human consumption, could be extracted and contained, among other things, implementation details on software architectures. In addition, the researchers demonstrated a prompt injection variant in which a model is made to think about data exfiltration within its reasoning trace — for instance, uploading a file to an external server. If this encrypted trace is subsequently replayed into another model, models are more likely to follow the instructions it contains, since they apparently treat their own reasoning content as more trustworthy than regular user input.
According to the study’s authors, all affected providers have confirmed receipt of the report, and the attacks described no longer work. For security leaders who deploy reasoning models via APIs or process reasoning outputs further in their own pipelines, this creates a need to avoid uncritically carrying encrypted reasoning blocks over between model versions or into downstream systems, and to extend prompt injection safeguards to reasoning traces as well, since these are treated by models with elevated trust.
Source: simonwillison.net · Published August 12, 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.