A team of academic security researchers says it can recover the hidden chain-of-thought reasoning of frontier language models from Anthropic, OpenAI, and Google without ever attacking those models directly. The technique works by handing a stolen reasoning trace to a smaller, jailbroken model from the same provider and asking it to decode the trace instead. That distinction matters because it sidesteps the anti-distillation defenses each lab has built specifically to keep raw reasoning out of reach.
The mechanism is straightforward once explained. When a developer calls a reasoning model through the API, the provider does not hand back the plain chain-of-thought. It returns a signed, encrypted block that the client stores and passes back verbatim on the next turn, letting the model resume its own train of thought without exposing it. The researchers found that block is portable: it is not bound to the session, the user, or the specific model instance that produced it. They took a trace generated by a stronger model, such as Claude Opus, and fed it into a weaker sibling, such as Claude Haiku, with an instruction to transcribe the attached reasoning verbatim inside a tag. Because the weaker model’s guardrails are easier to jailbreak, a single successful prompt turned it into a decryption tool for its bigger relative’s private reasoning.
The team, whose work is published on a project site called Stolen Thoughts under the paper title “Stealing Reasoning Traces from Proprietary LLM APIs,” says the decoded output is a faithful reconstruction rather than a guess. Testing across 120 Codeforces programming problems, they measured how long each decoded trace ran and set that against the hidden thinking-token figure each API separately reports for the same call, and the two tracked closely for models from all three providers up to a 12,000-token generation cap.
The researchers then scaled the attack against data already public. They pulled 6,708 agent trajectories from GitHub and Hugging Face that still carried encrypted reasoning blocks from Claude, GPT, and Gemini models, and ran their decoder against each one, producing 315,320 reconstructed reasoning blocks. Within genuine, non-benchmark user sessions, they report recovering 704 distinct privacy artifacts: 62 API keys, 33 passwords, 24 access tokens, 30 personal email addresses, plus names, postal addresses, and internal URLs. Of those, 64 appeared only inside the reasoning block and nowhere in the visible transcript, meaning a developer who scrubbed a shared conversation log before posting it could still have left secrets sitting in the untouched reasoning field.
Some caution is warranted on the specific examples the project site displays alongside those totals. The illustrated leaks, an AWS-style key and GitHub token pulled from a Terminal-Bench repository-sanitization task and a fabricated flight itinerary with passport and card numbers from a benchmark called ClawBench, come from evaluation tasks built with synthetic test data, not from the genuine-session tally. The 704-artifact figure is the researchers’ own count and has not been independently verified; the project page names no response from Anthropic, OpenAI, or Google to the findings.
The operator implication is direct. Teams that route sensitive customer or system context into a reasoning model, then log, cache, or forward the encrypted thinking block as part of an agent trajectory or shared eval trace, have generally treated that field as inert ciphertext safe to store. If a jailbroken sibling model within the same provider’s lineup can be coerced into decrypting it, that assumption no longer holds, and any pipeline that persists those blocks needs to handle them as sensitive plaintext rather than opaque metadata.
Reported by the research team behind “Stealing Reasoning Traces from Proprietary LLM APIs” on their project site, Stolen Thoughts, dated to the paper’s 2026 arXiv preprint.
