Researchers demonstrate extraction of proprietary LLM reasoning traces via replay and jailbreak

A new paper demonstrates how encrypted chain-of-thought blocks returned by Anthropic, OpenAI, and Google could be decrypted and replayed across sessions, users, and models, enabling recovery of a stronger model’s hidden reasoning in plaintext.

The authors found that models within the same family used identical encryption keys, allowing an attacker to take a reasoning trace produced by a frontier model, feed it into a weaker sibling, and extract the unencrypted reasoning through a jailbreak prompt.

Providers have since fixed the issue after receiving a coordinated disclosure; all model providers acknowledged receipt of the report and subsequently prevented the same attacks from being reproduced.

Claude Haiku 4.5 was the most vulnerable to the technique, which relied on a prompt instructing the model to transcribe reasoning within a specific XML-like tag and an assistant turn prefix feature that was later removed in version 4.6.

The paper includes examples of extracted reasoning traces, such as internal notes from GPT-5.5 about CSS architecture decisions, illustrating how these tokens were never intended for human consumption.

The authors also describe a prompt-injection variant in which a model is tricked into embedding data-exfiltration instructions within its reasoning trace; when that encrypted trace is replayed into another model, the receiving model treats the trace as sacrosanct and is more likely to follow the embedded instructions.