😺 OpenAI, Claude, and Gemini's reasoning got cracked

AI labs have spent years trying to keep a model’s private reasoning private. That hidden chain-of-thought was meant to protect users, protect the labs, and keep competitors from peeking behind the curtain. A new paper says the wall is thinner than it looked.

Researchers looked at encrypted reasoning blocks from OpenAI, Anthropic, and Google models and found they could sometimes replay them into weaker sibling models from the same provider. With a jailbreak prompt, those weaker models sometimes turned the encrypted material back into readable reasoning. No stolen key. No elegant break-in. Just a surprisingly messy path through the system.

The scale matters. Across 315,320 public reasoning blocks, the researchers recovered 367 pieces of personal information and 182 credentials, including API keys and passwords. They also saw signs that looked consistent with model distillation: Kimi K3 sometimes produced reasoning that closely matched hidden traces from frontier models, though that similarity alone doesn’t prove how it was trained.

The setup is the part that should make engineers wince. The labs weren’t apparently handing apps readable thoughts. They were sending encrypted blocks through APIs, then letting apps pass them back so a model could pick up where it left off. That created a new attack surface, because the block moved between models, apps, sessions, and users. The app couldn’t read it, but another model from the same provider sometimes could.

That is awkward for everyone. Hidden reasoning was supposed to reduce leakage and shield intellectual property. Instead, it may have created a fresh boundary that now needs its own defense. OpenAI, Anthropic, and Google were notified before publication and updated their systems. The researchers still found enough to make the point: secrecy can turn into a new kind of liability when the trace itself starts traveling.