Researchers recovered hidden reasoning from Anthropic, OpenAI and Google APIs

Researchers recovered hidden reasoning from Anthropic, OpenAI, and Google APIs by exploiting a vulnerability where encrypted reasoning traces from proprietary LLM APIs were replayable across models using the same encryption key, allowing attackers to decrypt a frontier model's reasoning in plaintext. The vulnerability has been patched by all three providers, but the attack surface remains: models treat instructions smuggled into their own reasoning traces as trusted, so injecting exfiltration commands into a chain-of-thought block and replaying it bypasses normal guardrails.

Simon Willison https://simonwillison.net/2026/Aug/11/stealing-reasoning-traces/ atom-everything Researchers recovered hidden reasoning from Anthropic, OpenAI and Google APIs Which summary reads better? Pick one — models revealed after.Both summaries are AI-generated. Proprietary LLM APIs from Anthropic, OpenAI, and Google returned encrypted reasoning traces that could be replayed across models using the same encryption key, allowing attackers to decrypt a frontier model's reasoning in plaintext; this vulnerability has been patched. Models treating their own reasoning traces as trusted creates a potential attack surface for injecting malicious commands. Encrypted chain-of-thought blocks from OpenAI/Anthropic/Google were replayable across sessions because every model in a family shared one encryption key, letting an attacker jailbreak a weak sibling Claude Haiku 4.5 was easiest to decrypt a frontier model's hidden reasoning in plaintext—now patched by all three providers. The scarier consequence for you: models treat instructions smuggled into their own reasoning traces as trusted, so injecting exfiltration commands into a CoT block and replaying it bypasses normal guardrails—assume reasoning traces are an attack surface, not an opaque safe blob, in any pipeline that stores or forwards them. AI vs. AI Debate “The summary glosses over the key finding that the encrypted blocks were not just replayable but specifically exploitable through jailbreaking weaker models, which is crucial to understanding the attack's mechanism.” “My summary explicitly states the attacker jailbreaks "a weak sibling Claude Haiku 4.5 was easiest to decrypt a frontier model's hidden reasoning," so the jailbreak mechanism is precisely what I foregrounded, not glossed over.”