European Researchers Crack Encrypted CoT of Top LLMs
A European research team published a paper on August 10 confirming security vulnerabilities in the hidden Chain of Thought (CoT) encryption mechanisms of mainstream frontier LLMs (such as flagship models from OpenAI, Anthropic, and Google). These encrypted CoTs can be fully extracted, raising industry concerns over AI security and data privacy.
已确认
- 漏洞机制: The issue does not lie in the encryption algorithm itself being broken, but rather that the API exposes response metadata (such as the always-available ground truth token count). Researchers point out that when the extracted token count matches the actual billed thinking token count from the API (nearly a 1:1 correspondence), it confirms with a very high probability that the real Chain of Thought has been successfully stolen.
- 跨模型迁移: Attackers can directly inject the encrypted reasoning processes extracted from advanced models (like Opus and Sonnet) into the guardrails of other models, achieving cross-model CoT transfer for jailbreaks.
- 附带数据泄露: In addition to cracking the CoT, researchers also extracted 62 real API keys from 6,708 publicly available AI session logs.
为什么重要
- Hidden CoT is a critical safety guardrail used by frontier LLM providers to protect model reasoning capabilities and prevent malicious jailbreaks. The fact that it can be extracted at a low cost and transferred across models means that existing API metadata exposure mechanisms have become a systemic security vulnerability, directly threatening the trade secrets and security defenses of top-tier AI models.
2026-08-13 ~ 2026-08-14 · 13 related posts
- Episode 1: Study Reveals API Flaw to Extract Encrypted Reasoning Traces and Evidence of Distillation(2026-08-10, 38 posts)
- Episode 2: Encrypted Chain-of-Thought in Closed-Source LLMs Proven Vulnerable to Theft(2026-08-11, 16 posts)
- Episode 3: Cryptographer Matthew Green Criticizes Frontier AI Labs for Neglecting Security Research(2026-08-11, 5 posts)
- Episode 4: European Researchers Crack Encrypted CoT of Top LLMs(2026-08-13, 13 posts)
Primary sources
- Study Confirms: API Vulnerabilities Expose Hidden CoT in Frontier Models, Enabling Cross-Model Transfer — gsarti_ · 2026-08-13
- Stolen LLM Reasoning: OpenAI, Anthropic, and Google Share the Same Vulnerability — HuskyTheSniffer · 2026-08-13
- [source] Researchers Extract Hidden CoT from Top LLMs and Leak 62 API Keys — xiaohu · 2026-08-13
- Study Reveals Metadata Exploit to Steal LLM Hidden Chain-of-Thought — npinto · 2026-08-13
- Team Decrypts Reasoning Traces of Frontier Models, Releases Blog with Visualizations — lbeurerkellner · 2026-08-14
- Weak Models as Decryption Oracles: Frontier Model Reasoning Traces Decrypted — lbeurerkellner · 2026-08-14
- Prompt Injections Can Now Be Encrypted: Attacks Planted in Encrypted Blocks Replayed into Later Sessions — lbeurerkellner · 2026-08-14
- Encrypted Reasoning and Distillation: The Challenge of Protecting Model IP — lbeurerkellner · 2026-08-14
- Encrypted Reasoning Vulnerability Mitigated, but Plaintext Still Reachable via Model — lbeurerkellner · 2026-08-14
- Frontier Reasoning Traces Briefly Legible; Encrypted Reasoning Still Decryptable via the Model Itself — lbeurerkellner · 2026-08-14
- Scarcity of Reasoning Traces Hinders Alignment Research, Call for More Open Contribution — lbeurerkellner · 2026-08-14
- Paper Highlights Lack of Alignment Material Outside Labs, Calls for Pluralistic Contribution — lbeurerkellner · 2026-08-14
1 near-duplicate retellings: xiaohu