Researchers describe method to extract hidden reasoning traces from frontier model APIs

Researchers claim to have discovered a vulnerability affecting the APIs of multiple frontier AI companies, enabling the extraction of hidden reasoning traces from encrypted or signed blocks returned by models. The team, led by Alexander Panfilov, verified that the extracted reasoning token counts matched billed API thinking tokens on most queried prompts, indicating a direct correspondence between the hidden content and billed usage.

The disclosed technique involves obtaining a legitimate encrypted reasoning block from an API response and replaying it into a different request—potentially targeting a weaker model or a different account—where the reasoning is then transcribed. The paper provides model-specific templates for Claude, GPT, and Gemini, detailing how to bypass apparent safeguards, such as a ~50-token verbatim-output threshold, using chunked continuations and repeated sampling.

In a follow-up analysis, the researchers reported scanning approximately 7,000 public traces and identifying 62 unique API keys, 33 email addresses, 33 passwords, and other sensitive data within the decoded reasoning blocks. Notably, 64 instances of sensitive data appeared exclusively inside the reasoning blocks and not in the visible session content, underscoring the risk of unintentional exposure when sharing model traces publicly.

The paper emphasizes alignment and security concerns, including the potential for chain-of-thought (CoT) summarizers to obscure answers, reasoning traces becoming unintelligible, and the risk of cheating or attacks on websites. The authors note that the technique was responsibly disclosed, with several vulnerabilities already addressed by the affected companies, though similar attacks may still be feasible.

The disclosure has sparked debate about the severity of the privacy and security implications. Some researchers argue the attack does not necessarily enable scalable distillation of chain-of-thought for training purposes, framing the encryption as a stateless distributed-inference optimization rather than a robust confidentiality barrier. Others highlight operational security risks, such as the exposure of internal keys during investigations, and the difficulty of monitoring when decoded CoT is terse, fragmented, or multilingual.

The episode also raises broader questions about the reliability of hidden reasoning as a monitoring interface and the need for stronger safeguards around sandboxing, telemetry, and tool surfaces. Practitioners have noted that even when explicit thinking modes are disabled, tools like 'deep_think' can still induce internal CoT output, potentially re-exposing reasoning through alternative pathways.