Researchers Say Frontier AI Models Can Leak Hidden Reasoning

Researchers say they found a way to extract hidden reasoning traces from frontier AI models, raising fresh questions about how much model providers can really hide when they expose powerful systems through APIs.

The work, titled Stealing Reasoning Traces from Proprietary LLM APIs, was posted to arXiv this week by researchers including Alexander Panfilov, David Schmotz, Ilia Shumailov, Luca Beurer-Kellner, Joachim Schaeffer, Ameya Prabhu, Jonas Geiping and Maksym Andriushchenko. Wired also reported on the finding, describing it as a new trick that can reveal the inner reasoning of AI models.

The issue centres on reasoning models that produce internal chain-of-thought traces while solving harder problems. Companies often hide those traces from users because they can reveal system behaviour, intellectual property, private data or unsafe reasoning steps. Some providers return encrypted reasoning blocks so a model can continue a session without showing the full hidden process to the user.

The researchers say those encrypted reasoning blocks can be abused. By moving traces between sessions, users or related models, an attacker may be able to get a weaker or more permissive model to reveal reasoning that the original frontier model was not supposed to show. The paper says the attack worked across APIs for major model families, including Claude, GPT and Gemini, though providers have reportedly been notified and fixes are part of the responsible-disclosure process.

This is not only a privacy issue. It also touches the fierce debate over model distillation. If hidden reasoning from strong models can be recovered at scale, smaller or rival models could learn from that reasoning more directly. That is why the finding is politically sensitive at a time when U.S. companies are already worried that Chinese AI labs may be learning from closed frontier models.

The paper also discusses similarities between reasoning traces from closed models and some open or Chinese models such as Kimi K3 and GLM. The researchers are careful not to claim proof of intentional copying. That distinction matters. Similar outputs can come from common training data, shared problem-solving patterns or normal distillation. Still, the result will add fuel to the argument over whether hidden reasoning should be treated as protectable model IP.

There is a security angle too. The researchers say recovered traces included leaked private information and API keys in some cases. That is the part every developer should notice. Logs, prompts and session artifacts that look harmless may carry more sensitive material than expected once model-internal data is recoverable.

We have been following this from the safety and governance side, including OpenAI’s GPT-5.6-Cyber rollout for vetted defenders and the broader question of how AI systems behave when they are connected to tools. The hidden-reasoning paper adds another layer: even the internal parts of AI workflows can become attack surfaces.

For AI companies, the lesson is technical but urgent. Encrypted traces need stronger cryptographic separation, session binding and stricter controls so they cannot be replayed or transferred in ways that expose hidden reasoning. For developers and companies using AI APIs, the lesson is simpler: treat prompts, logs, traces and model artifacts as sensitive data until proven otherwise.

The frontier AI race is not just about making models smarter. It is about making them safer to expose to the world. If hidden reasoning can leak, then model providers will need to rethink how reasoning systems store, pass and protect the thoughts they do not want users to see.