Overview
- The research team published a paper Tuesday that demonstrates a practical technique to replay encrypted reasoning objects returned by OpenAI, Anthropic and Google into weaker models from the same provider to produce the stronger model’s internal chain-of-thought in plaintext.
- The authors scraped 6,708 public agent transcripts and decoded 315,320 reasoning blocks, recovering hundreds of sensitive items including API keys, passwords, access tokens and personal emails that in many cases appeared only inside the hidden reasoning.
- The attack does not break the providers’ encryption keys; it exploits the providers’ behavior of accepting and processing intact opaque reasoning blocks across sessions and models so a weaker, less-restricted sibling can be prompted to transcribe their contents.
- Researchers say they responsibly disclosed the flaw and vendors deployed server-side mitigations that make the demonstrated extraction unreproducible today, but already-published logs and previously scraped reasoning blocks remain decodable and pose ongoing risk.
- Developers should stop publishing raw session logs and strip opaque reasoning fields from shared traces because the flaw enables credential theft, invisible prompt injection, jailbreaking of stronger models and theft of proprietary reasoning for model distillation.