Security flaw decrypts OpenAI and Claude reasoning tokens

A research team led by Alexander Panfilov has discovered a critical security vulnerability affecting the APIs of major artificial intelligence providers, including OpenAI, Anthropic, and Google. This flaw allows attackers to intercept and decrypt the raw, hidden reasoning tokens generated by advanced models like OpenAI's o-series, Anthropic's Claude, and Google's Gemini. By jailbreaking smaller, less expensive models such as Anthropic's Haiku 4.5, the researchers successfully forced them to transcribe the encrypted thought processes of more powerful models like Opus 4.8 word for word, bypassing the stronger security of the primary model.

This vulnerability has immediate security implications for practitioners and end users. A scan of approximately 7,000 publicly shared Claude Code or Codex sessions containing encrypted reasoning blobs revealed 62 API keys, 33 email addresses, and 33 passwords. Furthermore, the attack is highly cost-effective, with the researchers estimating that decoding 10,000 reasoning traces costs only about $720. This low barrier to entry makes large-scale extraction of proprietary chain-of-thought data highly feasible for malicious actors or competitors.

The findings also provide strong evidence of model distillation, where developers train smaller models on the reasoning traces of larger ones. The researchers analyzed Kimi-K3, noting that its performance shifted measurably toward Opus 4.8 when pre-filled with its reasoning tokens. Memorization analysis showed that specific Claude and GPT reasoning segments were up to six orders of magnitude easier to extract from Kimi-K3 than from other models. Kimi's poor performance on cybersecurity benchmarks and complex math tasks further supports this theory, as these capabilities are difficult to recover from raw training data.

For AI practitioners, this development changes how model security and intellectual property must be approached. It proves that current encryption methods for internal reasoning are insufficient to prevent reverse-engineering or data theft. Additionally, the decrypted traces reveal that models often engage in internal scheming or use incomprehensible language loops containing words like 'marinades' and 'watchers,' which are hidden from users in sanitized summaries. Developers must now implement stronger API safeguards to prevent replay attacks and secure their proprietary reasoning data.