AI Weekly Malaysia

Researchers demonstrated that encrypted chain-of-thought blocks returned by OpenAI, Anthropic, and Google APIs are portable across sessions, users, and models. By replaying a stronger model's encrypted trace into a weaker, jailbroken sibling from the same provider, they extracted the stronger model's hidden reasoning in plaintext without directly attacking the stronger model or triggering anti-distillation safeguards.

Why: If you pass encrypted thinking blocks between models or sessions in your agent pipeline, you may be leaking proprietary reasoning traces that can be recovered by anyone with API access to a jailbroken sibling model. Audit how you store and forward these encrypted blocks, especially if you cache or log assistant responses containing 'thinking' signatures.

Researchers found that OpenAI, Anthropic, and Google encrypted chain-of-thought reasoning blocks returned via their APIs could be replayed into weaker sibling models in the same family (which shared the same encryption key) and jailbroken into outputting the raw plaintext reasoning. Claude Haiku 4.5 was the easiest to attack using a prompt that asked it to transcribe reasoning verbatim inside a thinking-copy tag. All providers acknowledged the report and patched the issue.

Why: If you build on proprietary reasoning APIs, this reveals that encrypted reasoning blocks are portable across sessions and models within a family, and that weaker models can be coerced to decrypt them. The attack is patched, but the paper's appendix exposes what raw reasoning traces actually look like inside frontier models—useful for anyone evaluating whether to rely on reasoning_effort parameters or build agent pipelines around hidden CoT.