[AINews] How to steal a Reasoning Trace A new paper demonstrates that encrypted reasoning traces from frontier AI models can be decoded and replayed to improve open models, with a scan of ~7,000 public traces revealing 62 unique API keys, 33 email addresses, and 33 passwords. The technique, disclosed by researchers including Jonas Geiping, exploits replay attacks on models like Claude Haiku 4.5, GPT, and Gemini, and several vulnerabilities have already been fixed. AINews How to steal a Reasoning Trace Speculative Decoding by any other name would distil as sweet It’s not very often that a paper breaks through to become headline story of the day. For understandable reasons https://www.latent.space/p/ainews-ai-cybersecurity-becomes-top both domestic https://www.latent.space/p/ainews-fearing-rsi-openai-anthropic and foreign https://www.latent.space/p/ainews-anthropic-accuses-deepseek?utm source=publication-search , there is renewed interest in the Interpretability Venn Diagram of alignment, security, and chain of thought monitoring, so today’s paper could not have come at a better time: Since the o1 launch https://www.latent.space/p/karina?utm source=publication-search , frontier lab reasoning models have obscured their traces, with cryptographic signatures, for fear of distillation not that this prevented anyone from Chinese labs accusing them of doing so . The first compromise was responsibly reported by Matthew Green https://blog.cryptographyengineering.com/2026/05/29/fooling-around-with-encrypted-reasoning-blobs/ in May, who broke down how it works and figured out how to replay and side channel these indirectly using latency measures. Today’s paper demonstrates that it is possible to DECODE and port these encrypted thoughts to different models/sessions/users… and to dramatically improve open models as a result The alarming note is here: “Further, if you ever shared online a Claude Code/Codex session with encrypted reasoning blobs, they can be decoded and leak your personal data.We did a preliminary scan of ~7,000 public traces and found 62 unique API keys, 33 email addresses, 33 passwords, and other sensitive data.” 64 appeared exclusively inside the reasoning blocksand nowhere in the visible session. The authors also detail alignment issues: The website https://stolen-thoughts.com/ has more examples. The technique is somewhat described in the paper: Obtain a legitimate encrypted/signed reasoning block from an API response. Replay that block into a different request—potentially another account/session—to a weaker model from the same provider. Place it in an assistant/model turn and prompt or prefill the weaker model to transcribe the attached reasoning. Sample repeatedly, discard refusals, and optionally reconcile multiple noisy transcriptions. The paper gives concrete templates with some minor variations per model: Claude: replay the signed thinking block to Haiku 4.5, followed by an assistant prefill such as