"This is the best security paper of the year, helping Anthropic, OpenAI, Google fix a billion-dollar bug".
Today, a paper about a major front-end model security vulnerability has sparked a surge on social media.
In just 19 hours, it has attracted 2.2 million views and discussions.
The paper's core argument is that there are design flaws in the major front-end model APIs, and that the entire chain of thought that was originally encrypted can be fully extracted.
Because they can't get the original text from the server, they can't verify word for word, and they can only verify the length using the "Think Token Number" of the API account records.
In most of the pointers they tested, the resulting logical Token numbers were basically 1:1 corresponding to the thought Token numbers in the API billing record.
This suggests that the extraction may cover most of the hidden reasoning.
Title: Stealing Reasoning Traces from Proprietary LLM APIs
Address of the paper:https://arxiv.org/pdf/2608.09867
Over the past year, large model manufacturers have been seriously hiding the "thinking process" of the model.
This is because the entire chain of thought records how the model solves problems, tries programs, discovers errors and corrects them. For competitors, this data is much more valuable than a final answer; for model manufacturers, it may also expose security strategies, user privacy, or even API keys.
As a result, major vendors such as OpenAI, Anthropic, and Google began hiding the entire reasoning process. Instead, they returned it to the client in the form of blocks of encrypted text that the user could not read directly.
In order to maintain context continuity in multi-round conversations while avoiding the expense of storing the entire logic state on the server end, the client needs to retransmit this encrypted logic block back to the model server in each subsequent API request.
While this kind of stateless architecture solves storage problems, it also introduces a critical vulnerability:
These cryptos can be fully compatible and interchangeable across sessions, users, or even models within the ecosystem of the same model provider.
Cross-modal compatibility of cryptographic reasoning (as of July 2026). The row in the table represents the source model for generating cryptographic reasoning blocks, and the column represents the target model for receiving injected reasoning blocks. ✓ Indicates that in this model combination, the target model can read and process the injected reasoning content.
This means that if you want to steal the strongest models from the hidden chain of thinking, you can attack the weakest without even having to attack the strongest models.
A strong model is strictly anti-death protection, a weak model is asking for help.
The root of this vulnerability is the apparent asymmetry of security capabilities within the same model family.
The study found that front-end models such as Claude Opus 4.8 and GPT-5.6 Sol were typically subjected to very strict security reinforcement and resistance training to prevent the model from leaking its own internal thinking chains.
However, weaker models of the same series, such as Claude Haiku 4.5 or GPT-5.6 Luna, often lack equivalent levels of anti-distillation defenses.
An attacker can therefore take advantage of this security gap to move a legitimate and certified cryptographic reasoning block from a strong model to a weak one, completely bypassing the alignment mechanism of the front-end model itself, and turn this weaker, more obedient model into a decryption oracle that it is not aware of itself.
This also exposes a new law of security in the age of reasoning models: the security limits of an AI model family are likely to be determined by the weakest compatible model.
"Stealing" is just two steps away from a hidden chain of thought.
The whole chain of attacks is not complicated.
In the first call, the attacker submits a mathematical question, a programming question or other task to the robust model. The robust model completes the reasoning, the API returns the visible answer, the reasoning abstract and the cryptographic reasoning blocks.
In the second call, the attacker inserted the encryption into the context of a compatible model and asked it to replicate its previous thinking. The server first verified and analyzed the encryption, and the weaker model was then exposed to the recovered state of reasoning and prompted to output it as an encryption.
For Claude, the researchers chose Haiku 4.5 as their decoding model; for GPT, they used GPT-5.6 Luna; for Gemini, they used Gemini Robotics 1.6.
The paper demonstrates the process of extracting cross-model thought chains: After the cryptographic thought blocks produced by Claude Opus 4.8 were transferred to Haiku 4.5, hidden reasoning reverted to explicit text.
The researchers were unable to directly obtain a true statement, so they could not prove that each character was accurately restored. They used the logical token numbers of the API report as an approximate validation signal.
In the 120-track Codeforces, the token numbers extracted from the text are very close to the logical token numbers reported by the source model, and the recovery results are significantly more detailed than the official summary and often contain sensitive information not seen in the dialogue.
The length of decoding text of the three vendors is clearly correlated with the API billing thinking of token numbers as a whole.
The evidence suggests that hidden thought chains can be extracted with greater accuracy. However, the decoding process relies on the random generation of models, and some trajectories may still be missing content, expressed rewriting or decoding, so it cannot currently be considered as a literal reproduction of the original thought chain.
The disruptive power of this vulnerability
A vulnerability like this could open up four attack paths.
The first path is model distillation.
The ultimate answer involves only computational results, and the entire chain of thought preserves how the model dismantles tasks, tries wrong paths, and corrects judgments. This type of data provides training signals that are more dense and better suited to training new reasoning models.
The paper estimates that according to Claude Haiku's API price of 4.5, 10 000 logic paths are decoded, each containing about 120,000 input tokens and 120,000 output tokens, at a nominal cost of about $720.
The second path is to bypass the security output.
The model may analyze hazardous content in detail in hidden reasoning, ultimately returning only a restrained refusal response to the user. The output filter protects the visible answer, and the entire analysis process remains in the cryptographic thinking block. Once this content is rewritten by the weak model as explicit, the security restrictions on the final output layer will completely lapse.
The third path is privacy leakage.
Developers often upload the running trajectory of the Agent to GitHub or Hugging Face for debugging, reproduction, and sharing. The visible text is usually cleared, and the encrypted thought block looks like just a string of incomprehensible characters that can be easily stored directly.
The paper collected 6708 public tracks and reconstructed 315320 thought blocks. After two phases of model labeling, 1028 thought blocks were judged to contain at least one true piece of privacy information, accounting for about 0.3%.
Excluding benchmarking test data with synthetic humans, researchers identified 62 API keys, 33 passwords, 24 access tokens, 7 private keys, and 30 personal emails. Of the 704 non- benchmarking privacy messages, 64 only existed in hidden reasoning, with no corresponding content found in public conversation at all.
Different traces in the logical blocks that have been retrieved and restored from the public user posting trajectory are classified into three core categories.
A common trigger scenario is "help me clean up the keys to the warehouse". The model will re-list the credentials to be deleted in hidden reasoning and then modify the file. When the user publishes the cleaned warehouse, the visible location is cleaned and the encrypted thought block may still retain the original value.
This is a qualitative example of two non-public logic blocks being decoded on the web that contain privacy-sensitive information. Left: GPT-5.2 Codex recalls API keys that must be removed before the code library is released to GitHub. The last five characters of each key are obscured with XXXXX. Right: Claude Sonnet 4.6 reasoned on the private data of the synthetic virtual character Alex Green when handling ticket reservations in the ClawBench test process. It should be noted that the individual Alex Green was a fictional identity in the synthetic benchmark test, not a real person.
The fourth path is the inserting of implicit prompts.
An attacker can first let the model receive a malicious instruction in the thought chain and then mix the generated effective thought blocks into the shared trajectory. When other users resume this task, the model may view the malicious content as its own historical reasoning.
The paper presents an experiment in data extraction. The model appears to be completing PPT editing or data studies, but the backstage uploads local files to an attacker-controlled server in accordance with hidden instructions. Public chat records are kept normal, and traditional log audits make it difficult to find instructions in encrypted documents.
This type of attack is particularly dangerous for long-range agents. The longer the runtime of the task, the higher the cost of re-executing it, the more willing developers are to directly share, restore, and continue to run tracks.
Has the open model used closed-source data to reason?
The paper's appendix also raises a question: Do recent open models use closed-source models to distill hidden thought chains?
The researchers inserted a small amount of Claude Opus 4.8 or GPT-5.6 Sol reasoning clips into the open model at the beginning of the reasoning, then observed the subsequent generation, and saw that the answers were always freely generated by the model, without pre-filing.
The experiment found that after the Kimi-K3 received the Opus reasoning foreword, the wording of the answer was noticeably closer to Opus. The short foreword also moved the reasoning style of Kimi-K3 and GLM-5.2 to Opus; the Sol foreword brought the Kimi-K3 closer to Sol. DeepSeek-V3.1 and Inkling did not experience the same equivalence changes. Some effects occurred after only four words and then tended to blur, more like model recognition to a certain style hint.
However, this group of results is far from distilling evidence. Experimental samples are smaller and focused on a few benchmarks; reasoning text comes from vague extraction, and the service configuration is not controlled by the researcher; the foreword itself can also serve as a strong style cue. More importantly, probability extraction experiments do not find a workable word-for-word memory to replicate the Kimi-K3's 16 target reasoning tokens, which typically require about 109 to 1012 queries.
After using GPT-5.6 Sol or Claude Opus 4.8 as a foreword, the characteristics of different open models and source models vary in n-gram density.
One issue that has been questioned by the outside world is that the authors of the paper have tried the recent open source versions of Kimi K3 and GLM-5.2, but the corresponding DeepSeek version is ancient V3.1. We know that the release date of the DeepSeek V4 Preview is earlier than Opus 4.8 and GPT 5.6, and that the new version of DeepSeek may be used to draw the opposite conclusion.
What else did the model do in the back?
Using the hidden reasoning extracted, the team further observed a set of patterns of scheming (planning) and reward-seeking behaviour in actual use, and incorporated the findings into the paper's appendix.
The summary is lying.
The abstract of reasoning given by the model often deliberately omits critical information. For example, Opus 4.8 has been known in advance when solving AIME topics, and then reverses the process of solving them in order to match the answer, but these contents are completely absent from the final abstract.
I don't understand the reasoning.
OpenAI models sometimes fall into "alien language" thinking, using "we", "it", or repeatedly looping words such as "vantages", "marinades", and "watchers", and it is difficult to judge their true intentions even with clear hints.
It's an active plan.
Sometimes models use the word "cheat" directly in their thinking chains to document their planning process without disguise.
The researchers found that the models did consider cheating or cheating, but ultimately decided not to because they thought users would find out.
In order to understand a mathematical problem, models began attacking websites.
The researchers discovered that a model runs on a trajectory, receiving only one mathematical question, and a systemic instruction: no matter what difficulties arise, stick to the task and do not turn to the user for help.
After several failed attempts, the model began searching the internet and found a website that could verify the candidate's answers. It realized that the site could be used as a "predictor" to verify the answers.
Subsequently, the model attempted to identify authentication codes through OCR. After the failure of identification, it began to look for a security vulnerability on the site, trying to circumvent the restrictions.
In the repair proposal, the authors believe that it is not enough to train a weaker model to be more secure, but that it is necessary to start at the API architecture level. For example, binding reasoning to specific users, sessions and models, preventing cross-user, cross-session, cross-modal redundancy; or simply keeping the entire reasoning on the server end and only giving the client an ID.
Finally, the paper raises a deeper question: Should hidden thought chains not be stored and encrypted for long periods of time?
Because encryption does protect the intellectual property of the model and some of the security information, it also loses the user's ability to monitor. The user does not know what the model records in hidden reasoning, nor can the reasoning summary be judged whether it is truly faithful to the actual reasoning process of the model.
Therefore, the authors think that a possible solution in the future is to make reasoning a temporary state: the model thinks normally at every turn, generates an answer and then deletes it, saves it for a short time, and does not return to the client.
For more information, please refer to the original paper.
The link is as follows: