Researchers Expose Vulnerabilities in Proprietary LLM Reasoning Traces
A research paper entitled "Stealing Reasoning Traces from Proprietary LLM APIs" has uncovered a flaw in the encrypted chain-of-thought (CoT) blocks utilized by AI companies Anthropic, OpenAI, and Google. The study illustrated how these encrypted traces could be reused across different sessions and models, enabling the jailbreak of less secure models and the retrieval of concealed reasoning in plaintext. The vulnerability took advantage of shared encryption keys within models of the same family. Included in the paper are reasoning traces from GPT-5.5 regarding CSS architecture. All providers have acknowledged the report, and the vulnerability has since been addressed. Claude Haiku 4.5 was identified as the most vulnerable. Simon Willison featured the paper on August 11, 2026, and it can be found at stolen-thoughts.com.
Key facts
- Researchers discovered a vulnerability in encrypted chain-of-thought blocks from Anthropic, OpenAI, and Google.
- The attack involved replaying a trace from a frontier model into a weaker sibling model to recover hidden reasoning.
- All models in the same family used the same encryption key, enabling the attack.
- Claude Haiku 4.5 was the easiest to attack using a specific prompt.
- The vulnerability has been fixed; providers acknowledged the report and attacks were no longer possible.
- The paper includes extensive details of extracted reasoning traces.
- GPT-5.5's reasoning about CSS architecture was revealed.
- Simon Willison posted about the paper on August 11, 2026.
Entities
Institutions
- Anthropic
- OpenAI
- Simon Willison