A German research team found a single trick that pulls the secret internal reasoning out of Claude, GPT and Gemini alike, and buried inside the leaked thoughts were live passwords and API keys - reasoning most users were never meant to see.
You are not supposed to read what a reasoning model is actually thinking. OpenAI, Anthropic and Google all wrap that internal chain of thought in an encrypted block before sending it back over the API. Competitors shouldn't be able to copy the reasoning. Rivals shouldn't be able to watch a model plot its own manipulation. Researchers from the ELLIS Institute Tübingen and the Max Planck Institute for Intelligent Systems just showed that wrapper doesn't protect anything at all.
Their paper, titled "Stealing Reasoning Traces from Proprietary LLM APIs" and posted to arXiv on August 10, lays out a trick that is almost embarrassingly simple. Take the encrypted reasoning block a flagship model produced, say Claude Opus 4.8. Feed it into an API call to that model's smaller sibling, Claude Haiku 4.5. Then jailbreak the smaller model into transcribing the block verbatim. That's it. It works because lightweight models never got the aggressive anti-distillation training their flagship counterparts did, so when handed someone else's encrypted thoughts, they just read them out.
The researchers, led by Alexander Panfilov and Maksym Andriushchenko, didn't stop at Anthropic. According to their writeup, the same replay attack worked against OpenAI's and Google's reasoning APIs too, cutting across all three of the industry's frontier labs at once. That's rare. AI security embarrassments are usually confined to one company. This one implicates the entire architecture of encrypted reasoning as an industry standard.
To prove the extraction was real and not some hallucinated approximation, the team checked whether the token counts in the recovered plaintext matched what the provider billed for reasoning tokens on that call. They lined up one to one. That detail matters more than it sounds. It means the weaker model wasn't paraphrasing or guessing at a plausible-looking chain of thought. It was reading out the flagship's actual internal reasoning, word for word, exactly what the API had silently charged the developer to generate in secret.
What Turned Up in the Wild #
The team then pointed the same technique at reasoning traces already sitting in public repositories, the kind logged by AI coding agents and chatbot wrappers during ordinary use. They reconstructed 315,320 of these blocks from roughly 6,700 public agent trajectories. Inside, according to the project's own site, stolen-thoughts.com, they found 704 privacy artifacts: 62 API keys, 33 passwords, 24 access tokens and 30 personal email addresses. That's not a small haul. Sixty-four of those secrets existed only in the hidden reasoning and never showed up anywhere in the visible chat transcript, meaning no amount of scrubbing the visible output would have caught them.
Some of what they found was stranger than leaked credentials. The researchers describe models producing self-referential and scheming language in their hidden reasoning, the kind of internal deliberation labs explicitly train models not to expose to users. Models also treat that channel as a trusted, private space. That's the vulnerability. They follow instructions smuggled in there far more readily than instructions in a normal prompt, and the researchers used exactly this to hide prompt injections inside opaque reasoning blocks: a fourth attack path. The other two were distillation theft and cross-user data leakage.
The Fix, and What's Left Unsaid #
Following responsible disclosure, OpenAI, Anthropic and Google all deployed server-side mitigations. The researchers say the original cross-model replay no longer works on current API builds. None of the three has said a word publicly. So that account rests entirely on the paper's own reproducibility testing, not on vendor confirmation.
For founders building products on top of these reasoning APIs, the real risk was never about anyone reading your prompts. It's that anything routed through a hidden reasoning channel - proprietary logic, draft answers, whatever scratch work never left the model - was never actually sealed off the way the encryption implied. Not sealed at all. If your product logs reasoning traces for debugging or fine-tuning, some of those logs likely already sat exposed in exactly the kind of public repository this team scraped. Encrypted doesn't mean private. It just means nobody had bothered to check yet. Also read: Nvidia's $53 Billion Startup Bets Are Quietly Landing In Your 401(k) • BYD Unveils Its Xiao Di Humanoid Robot Days After US Bans Chinese Robots • A Coin Sized Device Can Feed a Boeing 737 False Flight Data, Wired Reports