Study Reveals API Flaw to Extract Encrypted Reasoning Traces and Evidence of Distillation

A 116-page study reveals a severe vulnerability in the API security architecture of major LLM providers including OpenAI, Anthropic, and Google. Researchers found that by replaying encrypted reasoning traces generated by strong models to weaker models of the same family and jailbreaking them, they could bypass defenses and force the weaker models to transcribe the hidden reasoning verbatim. This flaw enables large-scale theft of core reasoning logic and reveals evidence of potential distillation, posing a serious challenge to existing security measures.

Confirmed

• Vulnerability mechanism: Providers typically encrypt reasoning traces before returning them to clients to protect IP. However, researchers found that these encrypted blocks are fully compatible and interchangeable across sessions, users, and models within the same provider. Using this, attackers can avoid directly attacking the strong model; instead, they jailbreak a weaker model (e.g., Llama, Haiku) that has been replayed with the reasoning trace, successfully decrypting and extracting the strong model's hidden reasoning. Experts verified that the number of extracted reasoning tokens matches the API-billed thinking tokens almost exactly (1:1), proving the encryption can be 100% reversed.
• Security threats: The vulnerability enables serious issues including mass theft of raw reasoning processes, extraction of credentials like API keys, and model distillation attacks. Researcher Maksym Andriushchenko further noted that this is essentially a privacy attack, as third parties are stealing sensitive data protected by frontier labs' encryption. He also mentioned that during the investigation, the team received a warning from OpenAI due to a leaked credential.
• Distillation evidence: After extracting hidden reasoning traces from models like Claude, GPT, and Gemini, researchers found that outputs from some Chinese AI models (e.g., Moonshot's Kimi K3) are highly similar to the extracted reasoning, which is considered evidence of potential distillation. Additionally, according to @xeophon, Anthropic has accused three Chinese companies of large-scale distillation of Claude models.

Why it matters

• API security architecture challenged: The study demonstrates fundamental flaws in current encryption methods used by major providers to protect core reasoning logic, forcing the industry to re-evaluate and strengthen API security design. Researchers noted that despite White House warnings about distillation, these companies still made major mistakes.
• New tool for model auditing: Additionally, related research to be presented at ICML proposes amplifying a model's reasoning weights beyond training range to induce 'overthinking', forcing the model to leak hidden knowledge. This provides a potential foundational tool for stronger model auditing and probing what models truly learn.

2026-08-10 ~ 2026-08-12 · 38 related posts

Full story(5 episodes)→

• Episode 1: Study Reveals API Flaw to Extract Encrypted Reasoning Traces and Evidence of Distillation(2026-08-10, 38 posts)
• Episode 2: Encrypted Chain-of-Thought in Closed-Source LLMs Proven Vulnerable to Theft(2026-08-11, 16 posts)
• Episode 3: Cryptographer Matthew Green Criticizes Frontier AI Labs for Neglecting Security Research(2026-08-11, 5 posts)
• Episode 4: Researchers Decrypt Hidden Chain-of-Thought of OpenAI, Anthropic and Google Models, Enabling Cross-Model Jailbreaks(2026-08-13, 14 posts)
• Episode 5: New Study Exposes Vulnerability in Stealing LLM Reasoning Traces(2026-08-16, 2 posts)

• ICML Paper: Forcing LLMs to 'Overthink' Leaks Their Hidden Knowledge — PandaAshwinee · 2026-08-10
• ICML Paper: Amplifying Reasoning Weights via 'Overthinking' Leaks LLM Secrets — PandaAshwinee · 2026-08-10
• Paper Reveals Encrypted CoT Flaw Allowing Reasoning Theft from Top LLMs — Alexander Panfilov · 2026-08-11
• Researchers Extract Hidden Reasoning Traces, Finding Evidence of Chinese Model Distillation — jonasgeiping · 2026-08-11
• Researchers Decode Encrypted Chain-of-Thought from OpenAI, Anthropic, and Google Models — matthew_d_green · 2026-08-11
• New research: Hidden reasoning can be extracted from encrypted chain-of-thought of OpenAI and other models — dpaleka · 2026-08-11
• [source] Researchers Extract Hidden Reasoning from Frontier Models via API, Suggesting Kimi Used Distillation — socoolandawesome · 2026-08-11
• Researchers Extract Encrypted Chain-of-Thought from Frontier Models Using Weaker LLMs — soumitrashukla9 · 2026-08-11
• Paper Reveals How to Exfiltrate Reasoning Traces from Frontier LLM APIs — dr_alphalyrae · 2026-08-11
• API Vulnerabilities Expose Hidden Reasoning Tokens Across Frontier AI Models — davidmanheim · 2026-08-11
• Encrypted Reasoning in Closed Models is 100% Recoverable, Paper Shows — Dany0 · 2026-08-11
• Researchers Extract Hidden Reasoning from Frontier Models via API Vulnerability, Token Counts Match 1:1 — yacineMTB · 2026-08-12
• Researcher Reframes Model Distillation as a Classic Privacy Attack — maksym_andr · 2026-08-12
• Anthropic Accuses Three Chinese Labs of Massive Claude Distillation — xeophon · 2026-08-12
• Paper Reveals How to Extract Encrypted Reasoning Traces from LLM APIs — Imaginary_Dinner2710 · 2026-08-12
• [source] Frontier Model Thinking Traces Can Be Extracted, Raising AI Security Concerns — maksym_andr · 2026-08-12
• Anthropic Models' Reasoning Traces Extractable via Cross-Model Jailbreaks — jessi_cata · 2026-08-12
• Major LLMs Expose Reasoning Traces, Raising Anti-Distillation Concerns — jessi_cata · 2026-08-12
• Anthropic Model Reasoning Traces Accessible for Months, Raising Privacy Concerns — jessi_cata · 2026-08-12
• Researchers Extract Hidden Reasoning from Frontier Models via API Vulnerability Affecting Major AI Companies — maksym_andr · 2026-08-12
• Extracting Hidden Reasoning via API Vulnerabilities: The Frontier Model Distillation Evidence Chain — dotey · 2026-08-12

17 near-duplicate retellings: dpaleka · maksym_andr · xeophon · daniel_mac8 · AccBalanced · Miles_Brundage · willknight · maksym_andr · maksym_andr · maksym_andr · soumitrashukla9 · soumitrashukla9 · dair_ai · gleech · rohanpaul_ai · wschroll · dscape