Researchers Extract Reasoning Traces from Major AI APIs
A new paper demonstrates large-scale extraction of raw reasoning traces from OpenAI, Anthropic, and Gemini models via API flaws.
Maksym Andriushchenko and coauthors released a 116-page paper detailing extraction of encrypted chain-of-thought outputs from OpenAI, Anthropic, and Gemini APIs. Multiple researchers, including Timothée Chauvin and Alexander Panfilov, posted that the encryption was implemented poorly enough to allow recovery of hidden reasoning tokens at scale. The extracted token counts matched billed thinking tokens one-to-one on most tested prompts. Commenters noted the work also surfaces examples of illegible reasoning, especially from GPT models, and discussed related risks such as distillation attacks and credential extraction. The site stolen-thoughts.com presents the core finding that encrypted blocks are interchangeable across sessions, users, and models.
We can finally talk about it: We found a way to extract hidden reasoning of frontier models using a vulnerability in the APIs of every frontier AI company. We verified that our reasoning token count matches billed API thinking tokens 1:1 for most of the prompts we queried.
Reactions from ranked influencers
100 postsA new paper shows that encryption of chain-of-thought was done really poorly across Anthropic, OpenAI, Google. It's not very consequential, but is another example imo of them going so fast that they fail at basic security stuff.
Some background: In May, @matthew_d_green found that encrypted reasoning could be replayed outside its original context, and reported it to the labs (https://blog.cryptographyengineering.com/2026/05/29/fooling-around-with-encrypted-reasoning-blobs/). The labs said that "they…
2) Illegible reasoning: We confirm prior reports by @ApolloResearch: OpenAI models sometimes reason in alien-like language, referring to themselves as “we” or “it,” or spiraling into cursed loops of “vantages,” “marinades,” and “watchers.” CoT-monitoring people are doing God’s…
Probably one of the most exciting projects I contributed to recently
We can finally talk about it: We found a way to extract hidden reasoning of frontier models using a vulnerability in the APIs of every frontier AI company. We verified that our reasoning token count matches billed API thinking tokens 1:1 for most of the prompts we queried.
New paper!! We decoded the "encrypted" chain-of-thought of Anthropic, OpenAI and Google models and used this for multiple attacks! Explore: and https://arxiv.org/abs/2608.09867
💥 Our new 116-pages long paper: we extract encrypted raw reasoning from OpenAI, Anthropic, and Gemini models at scale. This vulnerability leads to many security issues, including distillation attacks and credential extraction. We also find a lot of examples of illegible…
We can finally talk about it: We found a way to extract hidden reasoning of frontier models using a vulnerability in the APIs of every frontier AI company. We verified that our reasoning token count matches billed API thinking tokens 1:1 for most of the prompts we queried.
