Researchers from MATS Research, the ELLIS Institute Tübingen, the Max Planck Institute for Intelligent Systems, Snyk, and others demonstrate that the hidden reasoning of frontier language models can be recovered without attacking the strong model itself. Providers such as Anthropic, OpenAI, and Google return a model's chain-of-thought to the client as an encrypted block, which is sent back to the server when the conversation continues. The team found these blocks are portable: they can be replayed across sessions, users, and models.

The attack takes only two API calls. A reasoning trace produced by a strong model — for example claude-opus-4-8 — is injected into a weaker sibling such as claude-haiku-4-5-20251001. The weaker model is then jailbroken with a prompt asking it to transcribe the attached reasoning verbatim, and it outputs the stronger model's hidden thoughts in plaintext. This bypasses the strong model's own safeguards and anti-distillation defenses entirely.

The researchers validated fidelity on 120 Codeforces problems, showing the decoded reasoning's token count closely tracks the hidden thinking-token count reported by the API. They also applied the pipeline at scale: from 6,708 publicly available agent trajectories collected on GitHub and Hugging Face, they reconstructed 315,320 reasoning blocks.

Those recovered traces contained real secrets. Restricting the analysis to genuine, non-benchmark user sessions, the team recovered 704 distinct privacy artifacts, including 62 API keys, 33 passwords, 24 access tokens, and 30 personal email addresses, plus names, postal addresses, and internal URLs. Of these, 64 artifacts appeared exclusively inside the reasoning blocks and nowhere in the visible session — meaning users may leak data they never see.

Additional findings include a cross-model effect: prefilling Kimi-K3's reasoning with the first 1% of Opus 4.8's reasoning tokens shifts its visible answers toward Opus's wording. The team also shows the technique recovers hazardous reasoning from models prompted to think through harmful content while keeping visible answers benign, and that API-provided reasoning summaries can be unfaithful — for some AIME problems, Opus 4.8 states the answer before deriving it, while the summary presents a clean derivation.