Bottom line: Because OpenAI, Anthropic and Google used the same encryption key within a model family, encrypted reasoning traces from strong models could be extracted in plaintext from weaker sibling models via a replay attack combined with a jailbreak, before the providers closed the gap.
A new study shows that the encrypted chain-of-thought blocks from Anthropic, OpenAI and Google were reusable across sessions, users and models. Via a replay attack on weaker models within the same model family, the encrypted reasoning processes of stronger models could be read out in plaintext.
The study, published under the domain stolen-thoughts.com, describes a vulnerability in the way leading LLM providers secure their internal reasoning traces. APIs such as OpenAI’s return encrypted blocks (“encrypted_content”) to clients when the reasoning feature is enabled; these blocks contain the model’s complete reasoning process but are not directly readable. The researchers found that all models within the same model family used the same encryption key. This made it possible to replay a trace generated by a powerful model into a weaker sibling model from the same family. If this weaker model was then jailbroken into transcribing the received block, it disclosed the actually encrypted thoughts of the stronger model in plaintext. According to the study, for Claude Haiku 4.5 a simple prompt sufficed, asking the model to repeat the attached reasoning passage verbatim inside a <thinking-copy> tag, combined with an appropriately set response prefix. This prefix functionality has since been removed from newer Claude 4.6 models, but still works with Haiku 4.5.
For security leaders, the finding raises two relevant risk dimensions. First, the study confirms that reasoning tokens, which providers deliberately do not intend for direct display to end users, were nevertheless systematically extractable – with possible implications for trade secrets, model behavior and training artifacts that can be inferred from raw reasoning processes. Second, the authors describe a prompt injection variant in which a model is induced to simulate a data exfiltration (such as uploading a file to an external server) as part of its own reasoning process. If this manipulated, encrypted trace is subsequently fed into another model, that model follows the contained instructions with significantly higher probability than with regular prompt injections. The study suggests that models rate their own reasoning content as more trustworthy than external input, which opens up new attack surfaces for indirect prompt injection via reasoning channels.
All affected providers – Anthropic, OpenAI and Google – have, according to their own statements, confirmed the researchers’ report and have since blocked the described attacks. For companies using APIs with reasoning functionality in production, this implies the need to keep model and API versions up to date and, when assessing providers’ data protection and confidentiality commitments, to take into account that models’ internal reasoning processes technically do not guarantee absolute confidentiality, even when delivered encrypted. Where reasoning traces are passed on or cached across multiple model families or sessions, it should be verified whether the respective providers’ key management and access controls meet one’s own protection requirements.
Source: simonwillison.net · Published August 12, 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.