Researchers recover encrypted chain-of-thought from Claude, OpenAI and Google APIs in two calls
Miles_Brundage · x · 2026-09-11
A paper from Tübingen researchers, Stealing Reasoning Traces from Proprietary LLM APIs, shows that Anthropic, OpenAI, and Google all return encrypted chain-of-thought blocks to clients that can be replayed across sessions, users, and models.
Attack flow:
- Take an encrypted, signed thinking trace from a frontier model (e.g., Claude Opus);
- Replay it into a weaker sibling (e.g., Claude Haiku) with a jailbreak prompt asking the model to transcribe the attached reasoning verbatim;
- Recover the stronger model's hidden reasoning in plaintext without attacking it directly or tripping its anti-distillation safeguards.
The authors say Anthropic has confirmed its models were distilled in the way they describe. The finding lands alongside Anthropic's most detailed threat intelligence report to date, covering cyberattack, influence-operations, surveillance, and biology misuse cases — all disrupted — with lessons folded back into safeguards. The team also built a "guess the model" game showcasing decoded reasoning.
More from Safety
- Outsider with no GitHub role deleted Dodo Payments' private repo, audit log shows — kingslyj · 2026-10-28
- OpenAI researcher: frontier AI ideas can't be patched for safety after the fact — willdepue · 2026-10-28
- Altman: models will find bugs 'outside the normal threat model' and patching won't save us — wfithian · 2026-10-28
- Report claims Anthropic Slack breach gave attackers full admin access to research secrets — willdepue · 2026-10-28
- Codex scans your connectors/MCPs unprompted in the background, and you can't tell — kenziyuliu · 2026-10-28
- Claude analysis flags TikTok and Instagram for allegedly bypassing mic permissions — thunderbong · 2026-10-28