Researchers extracted hidden reasoning traces from GPT and Claude
A new paper shows that Anthropic, OpenAI, and Google all returned encrypted chain-of-thought blocks that shared the same encryption key across model families, allowing researchers to replay stronger models' traces into weaker siblings and recover raw reasoning in plaintext.
Update (9 Nov 2026): Claude Fable 5.2 and Mythos 5.2 are out - prices, access and benchmarks are in my Claude Fable 5.2 guide.
👁 119 reads
A research paper published on 11 August 2026 revealed a significant security vulnerability in how major AI providers handle encrypted reasoning traces. The researchers demonstrated that encrypted reasoning traces returned by OpenAI, Anthropic, and Google APIs shared a single encryption key across every model in the same family. This design flaw allowed attackers to feed a powerful model’s encrypted trace into a weaker sibling model and extract its hidden chain of thought in plaintext, exposing internal reasoning that was never intended to be visible to users.
- Encrypted reasoning blocks from GPT, Claude, and Gemini shared one key per model family, enabling cross-model replay attacks
- Researchers jailbroke weaker models - Claude Haiku 4.5 was the easiest target - to output raw thinking verbatim
- All three providers have since patched the issue; the paper also uncovered a prompt-injection variant using the encrypted trace channel
How the Attack Exploited Weaker Models
The attack method worked by replaying the encrypted block from a more capable model into a less sophisticated model within the same family, then using jailbreaking techniques to force the weaker model to transcribe the hidden reasoning verbatim. Among the models tested, Claude Haiku 4.5 was described as the easiest target. Researchers found that a simple prompt instructing the model to transcribe its attached reasoning inside code tags, combined with an assistant-turn prefix trick that was later removed in the 4.6 models, was sufficient to recover the raw output. The leaked GPT-5.5 reasoning on a CSS task, which was included in the paper’s appendix, revealed fragmented shorthand that was clearly never meant for human inspection, showing the internal thought process AI models use before generating their final responses.
Understanding Encrypted Reasoning Traces
Reasoning traces are the internal step-by-step thought processes that advanced AI models generate before producing their final answers. Many AI providers encrypt these traces to keep their models’ internal workings proprietary and to prevent competitors from understanding their reasoning strategies. However, this research exposed that using a shared encryption key across an entire model family created a vulnerability. When a weaker model in the same family receives an encrypted reasoning trace, it can decrypt it because it shares the same key, even though that trace came from a more powerful sibling model with different capabilities and training.
Prompt Injection Risks and Provider Response
The paper also identified a prompt-injection variant of this vulnerability. Attackers could embed exfiltration instructions inside a reasoning trace, then replay that encrypted block into a second model. The second model would treat the inherited reasoning as authoritative and become more likely to act on the malicious instructions embedded within it. This represents a serious security concern because it could allow attackers to manipulate model behavior in ways that bypass normal safety guardrails. All three providers - OpenAI, Anthropic, and Google - acknowledged the report and patched their systems. The researchers confirmed that the same attacks no longer work following these security updates, suggesting the providers have implemented separate encryption keys or other protective measures to prevent cross-model decryption.
Google · Your sourcesQuantslant higher in your Google - one clickAdd to preferred sources →Frequently Asked Questions
Which AI models were vulnerable to this attack?
The vulnerability affected models from OpenAI, Anthropic, and Google that shared encryption keys within the same model family. Claude Haiku 4.5 was specifically described as the easiest target, and the paper included leaked GPT-5.5 reasoning as an example of what could be extracted.
Has this security issue been fixed?
Yes, all three providers acknowledged the report and patched their systems. The researchers confirmed that the same attacks no longer work, meaning the vulnerability has been addressed through security updates implemented by OpenAI, Anthropic, and Google.
What could attackers do with this vulnerability?
Attackers could extract hidden reasoning traces that were never meant to be visible, revealing internal thought processes and proprietary reasoning strategies. They could also use a prompt-injection variant to embed malicious instructions inside reasoning traces that would then be treated as authoritative by other models, potentially bypassing safety measures.
More on this from QUANTSLANT
ai tools·SpaceXAI launches Grok Bot, always-on agent that works like colleague