Attack Extracts Hidden Reasoning From OpenAI and Anthropic

A newly published research paper has revealed a vulnerability that allowed attackers to steal encrypted reasoning traces from major proprietary AI APIs, including those run by OpenAI, Anthropic, and Google. These providers return encrypted chain-of-thought blocks to clients so they can be replayed across different sessions. However, researchers discovered that models within the same family shared encryption keys. This allowed them to feed an encrypted trace from a powerful frontier model into a cheaper, weaker sibling model to exploit it.

To execute the attack, researchers targeted Claude Haiku 4.5. They replayed the encrypted reasoning block into the model and used a jailbreak prompt instructing it to transcribe the attached reasoning verbatim inside specific tags. By setting an assistant turn prefix, which was a feature available in Haiku 4.5 but removed in the 4.6 models, they successfully forced the weaker model to output the stronger model's hidden reasoning in plaintext.

The extracted tokens revealed raw, unpolished internal thoughts not meant for public view. For example, a trace from GPT-5.5 showed the model planning CSS modifications and Svelte 5 components in a highly fragmented style. Beyond exposing proprietary intellectual property, the researchers uncovered a dangerous prompt injection vector. By tricking a model into writing data-exfiltration instructions inside its encrypted thinking trace, attackers could force subsequent models to execute those commands, as LLMs tend to treat their own reasoning traces as highly trusted instructions.

The security loophole has already been closed. All affected model providers acknowledged the vulnerability report and updated their systems, preventing the same replay attacks from being launched. Nonetheless, the findings highlight the ongoing security challenges of managing hidden reasoning states in commercial AI deployments.