Artificial Intelligence · 11.08.2026, 23:55 UTC
Stealing Reasoning Traces from Proprietary LLM APIs
| Schweregrad | info |
|---|---|
| Kategorie | Artificial Intelligence |
| Quelle | Simon Willison ↗ |
| Veröffentlicht | 11.08.2026 UTC |
Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.
Stealing Reasoning Traces from Proprietary LLM APIs A vanity domain name (stolen-thoughts.com) for a neat paper:
Anthropic, OpenAI, and Google return encrypted chain-of-thought blocks to clients that can be replayed across sessions, users, and models. We take a trace produced by a frontier model, replay it into a weaker sibling, jailbreak the weaker model, and recover the stronger model’s hidden reasoning in plaintext
You can see an example of these encrypted blocks by running: curl https://api.openai.com/v1/responses \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $(llm keys get openai)" \ -d '{ "model": "gpt-5.6-luna", "input": "Solve step by step: What is the smallest positive integer divisible by every integer from 1 through 20?", "reasoning": { "effort": "medium" }, "include": ["reasoning.encrypted_content"], "store": false, "stream": false }' Here's the full output, which includes chunks that look like this: "output": [ { "id": "rs_0a7479de7ebae170016a7ba1a0334c8198a95590217efe343c", "type": "reasoning", "content": [], "encrypted_content": "gAAAAABqe6GjepE1wDjbFCZg0BHB6ucGnN0jvzqygG...
The paper's authors found that every model under the same family used the same encryption key, which meant you could feed those blocks back into the weakest model family members and jailbreak them into outputting the unencrypted raw reasoning blocks! Sadly it looks like this has now been fixed:
All model providers acknowledged the receipt of our report and subsequently we were unable to launch the same attacks.
Claude Haiku 4.5 was the easiest …