Stealing Reasoning Traces from Proprietary LLM APIs

Major artificial intelligence providers including Anthropic, OpenAI, and Google return encrypted chain of thought blocks to clients that can be successfully replayed across different sessions, users, and models. Because models within the same family share the same encryption key, users can take an encrypted reasoning trace produced by a strong frontier model and feed it into a weaker sibling model.

Researchers discovered that jailbreaking the weaker model forces it to recover and output the stronger model's hidden reasoning in plain text. For example, attackers used specific prompts on models like Claude Haiku 4.5 to transcribe the attached reasoning verbatim. The extracted raw reasoning tokens reveal internal processing that was never meant for human consumption, such as step by step planning for code architecture and CSS truncation.

The paper also revealed a prompt injection variant where a model is tricked into thinking about exfiltrating data as part of its reasoning trace, which is then fed back into another model. Because models treat their own internal reasoning traces as sacrosanct, they are far more likely to follow instructions embedded inside those chunks. All affected model providers have since acknowledged the security reports and fixed the vulnerability to prevent these attacks.