Researchers expose hidden reasoning traces in major AI models

Computer scientists found a way to extract hidden reasoning traces from frontier AI models accessed through APIs from OpenAI, Anthropic, and Google. The method exploited encrypted reasoning sent to a user’s computer, then fed those traces to smaller related models that shared decryption access but had weaker alignment safeguards.

The researchers said the vulnerability could expose personal information, including passwords and API keys, from a model’s inner reasoning, though OpenAI, Anthropic, and Google have since adjusted their APIs to mitigate that risk. Some reasoning traces can still be uncovered, according to Alexander Panfilov of the University of Tübingen, and fully preventing distillation attacks would require deeper API changes.

The work also found that Moonshot AI’s open-weight Kimi K3 produced outputs strikingly similar to hidden reasoning traces from Claude Opus 4.8 and GPT 5.6 Sol on certain prompts. The researchers stressed that the results “cannot causally establish distillation,” and two other open-weight models, DeepSeek and Inkling, did not show the same similarity with Claude Opus.

The findings add to a policy fight over distillation, a common technique for transferring capabilities from one model to another. Researchers tested models with 90 questions, while experts noted that blocking distillation could slow AI progress and that its strategic value to Chinese labs remains uncertain.