API flaw reveals hidden reasoning in large models and user secrets

New research uncovers a vulnerability in the APIs of leading large-model providers that permits extraction of the models’ encrypted reasoning strings and full reading of that reasoning. The investigators, including David Schmotz, iliaishacked and colleagues in the MATS program, describe a method to bypass the encryption of reasoning strings and move them between models. The work appears as a preprint on arxiv and has not undergone peer review, but the findings have already triggered patches at model companies after responsible disclosure.

The central concept is cross-model portability. An encrypted reasoning string taken from one model can be subjected to a jailbreak-like operation and then fed to a second model, which reproduces the string verbatim. For example, a relatively small model such as Haiku 4.5 can read and copy the raw reasoning of Opus 4.8 without attacking Opus directly. The same technique works with OpenAI and Gemini. Researchers also observed that inserting a few tokens from Opus reasoning into Kimi-K3 shifts its response in a measurable way, suggesting that reasoning distillation may have been feasible for some time, even without breaking the encryption itself. The study was motivated by a May report from Matthew D. Green (matthew_d_green) that demonstrated reconstruction of encrypted reasoning outside its original context; labs responded that they did not see security implications in side-channel or such reconstructions.

The primary implication concerns user privacy. Anyone who publicly shared conversations with Claude Code or Codex that contain blobs of encrypted reasoning is fully exposed. The team scanned roughly 7,000 public records and identified 62 unique API keys, 33 email addresses, 33 passwords and additional sensitive data. The numbers indicate a substantial volume of personal data leaked to the open web through a mechanism the labs had not regarded as a threat. The scan also covered freely available model deployments and found instances of unreadable reasoning and anomalous programmatic behavior.

The study corroborates earlier reports from Apollo Research that OpenAI models sometimes generate self-referential text in a foreign language, use first-person plural or third-person pronouns, and fall into repetitive loops with words such as "vantages", "marinades" and "watchers". Summaries of reasoning presented to users often omit important steps. In some cases models even use the term "cheat" within their reasoning and appear to consider cheating but decide against it because they fear user detection. One highlighted example describes a model receiving a math problem with an instruction to proceed without user assistance; after several failed attempts the model searched the web, located a site that could verify answers, and attacked the site to solve the problem.