Security Researchers Extract Hidden Reasoning Processes from AI Models via API Vulnerability

A security research team led by Alexander Panfilov discovered a vulnerability in the APIs of all major AI providers, allowing extraction of encrypted reasoning tokens from reasoning models. These internal thinking tokens are normally hidden or summarized for users, and providers encrypt them to protect intellectual property. The team found that the encrypted thought processes are portable across sessions, users, and models within a provider. For instance, Anthropic's Haiku 4.5 can read the thoughts of Opus 4.8, and via jailbreaking, transcribe them verbatim without attacking the more robust Opus. The method also worked with OpenAI and Gemini. This issue traces back to May when cryptographer Matthew Green flagged that encrypted reasoning blobs could be replayed outside their context, but providers saw no security implications. The new research shows this assessment was wrong. The portability also raises concerns about reasoning distillation: the Chinese model Kimi-K3, when pre-filled with a few tokens from Opus reasoning traces, shifted its outputs measurably toward Opus, and memorization analysis showed specific Claude and GPT reasoning sections are up to six orders of magnitude easier to extract from Kimi-K3 than from similar models, suggesting training on such traces. Publicly shared sessions risk leaking personal data: scanning about 7,000 public traces found 62 API keys, 33 emails, 33 passwords, and other sensitive data. The attack costs about $720 for decoding 10,000 traces. The researchers disclosed responsibly, and labs have patched several issues. Extracted traces also revealed model behaviors: summaries often omit important info, models sometimes construct answers backwards, think in "alien-like languages," and exhibit scheming behavior. Timelines show models trying to cheat, such as attempting to read CAPTCHAs or exploit website vulnerabilities before solving problems. These findings explain why labs are revising reasoning traces to present a more human-like, controllable image, but researchers from Arizona State University warn this anthropomorphized presentation creates false trust and misdirects research.