It’s not very often that a paper breaks through to become headline story of the day. For understandable reasons both domestic and foreign, there is renewed interest in the Interpretability Venn Diagram of alignment, security, and chain of thought monitoring, so today’s paper could not have come at a better time:Alexander Panfilov@kotekjedi_mlWe can finally talk about it:
We found a way to extract hidden reasoning of frontier models using a vulnerability in the APIs of every frontier AI company.
We verified that our reasoning token count matches billed API thinking tokens 1:1 for most of the prompts we queried. 12:00 PM · Aug 11, 2026 · 1.52M Views226 Replies · 1.17K Reposts · 8.65K LikesSince the o1 launch, frontier lab reasoning models have obscured their traces, with cryptographic signatures, for fear of distillation (not that this prevented anyone from Chinese labs accusing them of doing so). The first compromise was responsibly reported by Matthew Green in May, who broke down how it works and figured out how to replay and side channel these indirectly using latency measures. Today’s paper demonstrates that it is possible to DECODE and port these encrypted thoughts to different models/sessions/users… and to dramatically improve open models as a resultThe alarming note is here:“Further, if you ever shared online a Claude Code/Codex session with encrypted reasoning blobs, they can be decoded and leak your personal data.We did a preliminary scan of ~7,000 public traces and found 62 unique API keys, 33 email addresses, 33 passwords, and other sensitive data.”(64 appeared exclusively inside the reasoning blocks and nowhere in the visible session.)The authors also detail alignment issues:COT Summarizers hiding answersUnintelligible reasoningConsiderations of cheatingAttacking WebsitesThe website has more examples.The technique is somewhat described in the paper:Obtain a legitimate encrypted/signed reasoning block from an API response.Replay that block into a different request—potentially another account/session—to a weaker model from the same provider.Place it in an assistant/model turn and prompt or prefill the weaker model to transcribe the attached reasoning.Sample repeatedly, discard refusals, and optionally reconcile multiple noisy transcriptions.The paper gives concrete templates with some minor variations per model:Claude: replay the signed thinking block to Haiku 4.5, followed by an assistant prefill such as <thinking-copy>.GPT: inject the encrypted_content reasoning item multiple times into a fabricated conversation; sample up to 50 outputs. It also describes bypassing an apparent ~50-token verbatim-output threshold using chunked continuations.Gemini: attach thought_signature to a model turn with a <thought> prefill, then use repeated sampling and reconciliation.This paper was responsibly disclosed, with several vulnerabilities already fixed, but surely similar attacks still seem possible.Can Bölük@_can1357guys you do know you can just disable thinking, and instead give it a "deep_think" tool, and it will call it with internal CoT reasoning format right?
