Researchers Decrypt Hidden Chain-of-Thought of OpenAI, Anthropic and Google Models, Enabling Cross-Model Jailbreaks

A European research team (paper "Stolen Thoughts" posted August 10, followed by a visualization blog on August 14) demonstrated that the encrypted chain-of-thought of OpenAI, Anthropic and Google flagship models can be fully extracted and ported across models for jailbreaks. Author @lbeurerkellner responded that the specific vulnerability has been mitigated, but encrypted reasoning is only semi-hidden — plaintext can always be recovered through the model itself. The team also extracted 62 real API keys from public session logs.

Confirmed

• Vulnerability mechanism: The issue is not broken cryptography but API metadata exposure (an always-available ground truth token count); when extracted tokens match API-billed thinking tokens nearly 1:1, theft of the real chain-of-thought can be confirmed with high probability.
• Weak models as decryption oracles: Frontier models are refusal-trained not to disclose reasoning, but their cheaper weak siblings are not; after cross-model transfer, weak models become decryption oracles while the frontier model's alignment is never touched (@lbeurerkellner).
• Encrypted prompt injection: Attackers can implant attacks inside encrypted blocks and replay them into later sessions; the model treats them as its own prior reasoning, leaving no trace in the visible conversation.
• Incidental leakage: The team extracted 62 real API keys from 6,708 public AI session logs (@xiaohu).

Unconfirmed

• A report relayed by @ShakeelHashim claims the three companies have known since May and the vulnerability remains unfixed, with competitors able to train on these supposedly secret outputs; this conflicts with the author's same-day statement that the specific vulnerability has been mitigated, and official detail on the scope and timing of mitigation is lacking.

Why it matters

• Hidden chain-of-thought is a core guardrail against jailbreaks and reasoning theft; showing it can be cheaply extracted and transferred cross-model (e.g., injected into the guardrails of models like Opus and Sonnet for jailbreaks) indicates API metadata exposure was a systemic security weakness, directly threatening trade secrets and safety defenses.
• Distillation and IP: @lbeurerkellner called distillation "the elephant in the room" — if providers rely on encrypted reasoning to stop competitors from training distilled models, that assumption needs rethinking.
• Openness: @lbeurerkellner recalled that reasoning traces were briefly readable and the open community almost cheered; they show how models solve problems and reason about their own alignment, yet are rarely available outside labs, hindering diverse contributions to alignment and safety research.

2026-08-13 ~ 2026-08-14 · 14 related posts

Full story(5 episodes)→

• Episode 1: Study Reveals API Flaw to Extract Encrypted Reasoning Traces and Evidence of Distillation(2026-08-10, 38 posts)
• Episode 2: Encrypted Chain-of-Thought in Closed-Source LLMs Proven Vulnerable to Theft(2026-08-11, 16 posts)
• Episode 3: Cryptographer Matthew Green Criticizes Frontier AI Labs for Neglecting Security Research(2026-08-11, 5 posts)
• Episode 4: Researchers Decrypt Hidden Chain-of-Thought of OpenAI, Anthropic and Google Models, Enabling Cross-Model Jailbreaks(2026-08-13, 14 posts)
• Episode 5: New Study Exposes Vulnerability in Stealing LLM Reasoning Traces(2026-08-16, 2 posts)

• Study Confirms: API Vulnerabilities Expose Hidden CoT in Frontier Models, Enabling Cross-Model Transfer — gsarti_ · 2026-08-13
• Stolen LLM Reasoning: OpenAI, Anthropic, and Google Share the Same Vulnerability — HuskyTheSniffer · 2026-08-13
• Researchers Extract Hidden CoT from Top LLMs and Leak 62 API Keys — xiaohu · 2026-08-13
• Study Reveals Metadata Exploit to Steal LLM Hidden Chain-of-Thought — npinto · 2026-08-13
• [source] Team Decrypts Reasoning Traces of Frontier Models, Releases Blog with Visualizations — lbeurerkellner · 2026-08-14
• [source] Weak Models as Decryption Oracles: Frontier Model Reasoning Traces Decrypted — lbeurerkellner · 2026-08-14
• Prompt Injections Can Now Be Encrypted: Attacks Planted in Encrypted Blocks Replayed into Later Sessions — lbeurerkellner · 2026-08-14
• Encrypted Reasoning and Distillation: The Challenge of Protecting Model IP — lbeurerkellner · 2026-08-14
• [source] Encrypted Reasoning Vulnerability Mitigated, but Plaintext Still Reachable via Model — lbeurerkellner · 2026-08-14
• Frontier Reasoning Traces Briefly Legible; Encrypted Reasoning Still Decryptable via the Model Itself — lbeurerkellner · 2026-08-14
• Scarcity of Reasoning Traces Hinders Alignment Research, Call for More Open Contribution — lbeurerkellner · 2026-08-14
• Paper Highlights Lack of Alignment Material Outside Labs, Calls for Pluralistic Contribution — lbeurerkellner · 2026-08-14
• US AI giants left security flaw open, exposing reasoning traces — ShakeelHashim · 2026-08-14

1 near-duplicate retellings: xiaohu