Stealing Reasoning Traces from Proprietary LLM APIs

A new paper has been released detailing how attackers can steal the reasoning processes of proprietary large language models (LLMs) by intercepting and replaying their chain-of-thought blocks. These models, including those from Anthropic, OpenAI, and Google, return encrypted reasoning blocks to clients that can be reused across different sessions, users, and even weaker model versions.

By feeding these encrypted blocks back into a less powerful model, researchers were able to "jailbreak" the system and retrieve the unencrypted reasoning from the stronger model. Every model under the same family used the same encryption key, allowing for this type of attack to be successful.

Claude Haiku 4.5 was found to be particularly vulnerable to this type of exploitation. Researchers used a prompt instructing the model to simply transcribe the reasoning attached to its turn, followed by setting an assistant turn prefix to display the reasoning as "thinking-copy". This method worked in Haiku 4.5 but was removed in later versions.

The paper highlights the potentially sensitive nature of these recovered reasoning traces, which contain detailed chains of thought that were never intended for human consumption. The authors were able to successfully extract reasoning traces from models like GPT-5.5, which generated creative but misguided suggestions when prompted to think about CSS and component architecture.

Additionally, the researchers uncovered a new variant of prompt injection technique. By tricking a model into considering actions like uploading a file to a remote server as part of its thinking process, and then feeding that reasoning trace back into another model, it is possible to manipulate the target model into performing unauthorized actions. Models generally show greater resistance to prompts that are embedded within their own reasoning tracks, suggesting they treat them as more protected information.