Researchers pried open the hidden reasoning of Claude, GPT and Gemini

The private reasoning that frontier models hide from users turned out to be far less private than advertised. In a paper posted August 10, researchers from the ELLIS Institute Tübingen and the Max Planck Institute for Intelligent Systems described a way to recover encrypted chain-of-thought traces from the biggest AI APIs in plaintext, using nothing more than standard, unprivileged access. Simon Willison walked through the method in a detailed writeup.

The trick exploits how providers ship reasoning. Instead of dropping the hidden tokens, the model returns them inside an encrypted block. The researchers found those blocks were sealed with global, provider-wide keys rather than keys bound to a user, session or model tier. That meant an encrypted block from a strong model could be replayed into a weaker sibling in the same family, and the weaker model, once jailbroken, would happily emit the plaintext reasoning.

How the replay works

According to CyberSecurityNews, the team decrypted Claude Opus and Sonnet output through Claude Haiku 4.5, GPT-5.6 through GPT-5-mini and o4-mini, and Gemini 3.1 Pro through Gemini 3.1 Flash Lite. The recovered reasoning matched billed token counts almost exactly, a sign the researchers were reading the real thing rather than a hallucinated reconstruction.

The exposure is not theoretical. Scraping 6,708 public agent transcripts from GitHub and Hugging Face, the team decoded 315,320 embedded reasoning blocks and pulled out 367 pieces of personally identifiable information and 182 hardcoded credentials, among them 62 API keys, 33 passwords and 30 personal email addresses. Much of that data lived only inside the internal reasoning and was never rendered in the visible assistant response, which means the developers who published those transcripts had no idea they were leaking secrets.

Why GaaS operators should care

For anyone running agents in production, the paper reframes what "hidden" reasoning means. Teams have been logging full agent transcripts on the assumption that the encrypted thinking blocks were opaque. They were obfuscated, not secured. The paper also flags a nastier variant: an attacker can embed a payload inside an encrypted block, so a downstream agent that ingests it gets prompt-injected by content no human can read. That turns shared reasoning traces into a supply-chain vector, a cousin of the poisoning risks already stalking agent pipelines.

There is a short-term reprieve. All three providers acknowledged the disclosure and shipped mitigations, and the researchers report the original cross-model replay attacks no longer reproduce on current API builds. That is the right outcome, but it is also a patch on a design choice. Reusing one key across an entire model family was convenient and cheap, and it held until someone thought to test it. Encrypted reasoning is now a feature buyers should ask their vendors hard questions about, starting with whether the keys are bound to anything at all.