Stealing Reasoning Traces from Proprietary LLM APIs
- ID
- 13298
- Status
- summarized
- Published
- 12 Aug 2026, 6:40 AM
- Fetched
- 12 Aug 2026, 7:06 AM
- Provider
- Simon Willison
- Category
- developer-ai
- Original URL
- https://simonwillison.net/2026/Aug/11/stealing-reasoning-traces/
- Source URL
- https://simonwillison.net/atom/everything/
Summary
- Score
- 6.5
- Created
- 12 Aug 2026, 7:06 AM
- Tags
- Audience
- developersai_ml_learnersai_agent_users
What happened
Researchers found that OpenAI, Anthropic, and Google encrypted chain-of-thought reasoning blocks returned via their APIs could be replayed into weaker sibling models in the same family (which shared the same encryption key) and jailbroken into outputting the raw plaintext reasoning. Claude Haiku 4.5 was the easiest to attack using a prompt that asked it to transcribe reasoning verbatim inside a thinking-copy tag. All providers acknowledged the report and patched the issue.
Why it matters
If you build on proprietary reasoning APIs, this reveals that encrypted reasoning blocks are portable across sessions and models within a family, and that weaker models can be coerced to decrypt them. The attack is patched, but the paper's appendix exposes what raw reasoning traces actually look like inside frontier models—useful for anyone evaluating whether to rely on reasoning_effort parameters or build agent pipelines around hidden CoT.
Discussion angle
The fact that all models in a family shared the same encryption key is an architectural shortcut worth discussing—what does this tell us about how providers treat reasoning tokens, and should you avoid passing encrypted_content blocks between users or sessions in your own agent infrastructure?