Researchers Extract Hidden AI Reasoning Traces from Major APIs

Researchers at the University of Tübingen, the Max Planck Institute, MATS Research, and security firm Snyk have published a method for extracting the hidden chain-of-thought reasoning that frontier model providers encrypt and transmit to user machines during inference. The technique works against APIs from OpenAI, Anthropic, and Google — and what the recovered traces reveal has reignited the distillation debate: the open-weight Chinese model Kimi K3 from Moonshot AI produces reasoning outputs that closely mirror the hidden traces of Claude Opus 4.8 and GPT 5.6 Sol on certain prompts. "All major frontier model providers we tested share this vulnerability," says Alexander Panfilov, the University of Tübingen computer scientist who led the work. "It can lead to personal information leakage, and it enables large-scale reasoning distillation attacks."

For anyone building on or evaluating frontier LLMs through automated pipelines, this is not a theoretical concern. The vulnerability allowed recovery of passwords and API keys embedded in reasoning traces captured from a user's machine — a class of exposure that sits directly adjacent to the API token hijack risks already documented in AI coding agents.

How the Extraction Works

Frontier model providers typically offload some computation by sending an encrypted version of the model's chain-of-thought reasoning to the client, while also offering smaller, cheaper variants of the same models. Panfilov's team discovered that feeding those encrypted reasoning traces to a smaller sibling model yields the hidden reasoning in plaintext. The mechanism is alignment asymmetry: larger models receive substantially more alignment training and reliably refuse to expose their internal reasoning, while their smaller counterparts, sharing the same decryption capability, do not.

Florian Tramer, a computer security specialist at ETH Zürich, described the insight as "very cool," noting that swapping messages to a weaker model variant that holds the same decryption key but has weaker alignment is "definitely becoming an issue."

What the Recovered Traces Show

To test for potential distillation, the researchers fed 90 questions to each model under evaluation. When they supplied open-weight models with the first few tokens of reasoning traces recovered from proprietary models, they measured how closely the open models continued those traces. Kimi K3 showed a pronounced similarity to the hidden reasoning of both Claude Opus 4.8 and GPT 5.6 Sol. By contrast, DeepSeek and Inkling — the latter from US company Thinking Machines — did not exhibit comparable similarity to Claude Opus traces. The paper is explicit that the findings "cannot causally establish distillation," but the pattern is specific enough to name models and versions.

Moonshot AI and Z.ai did not respond to requests for comment before publication. Google and OpenAI declined to comment. Anthropic spokesperson Michael Aciman confirmed the company has "begun building short-term mitigations for the replay behaviors described in the report" and specified that the research did not involve recovering encryption keys or accessing Anthropic's infrastructure.

Mitigation Status and Structural Limits

Panfilov's team disclosed to OpenAI, Anthropic, and Google last month, and all three have since adjusted their APIs. The personal-information leakage vector — passwords, API keys — is now closed. However, Panfilov states that some reasoning traces remain recoverable using the same method. Full remediation would require a fundamental redesign of how these companies' APIs handle encrypted reasoning, not a patch. That architectural constraint is the critical takeaway for teams relying on API-delivered reasoning models: the mitigations applied are partial by the researchers' own assessment.

The Geopolitical Dimension

The policy context makes the technical finding harder to dismiss. In February, OpenAI told US lawmakers that DeepSeek appeared to have distilled one of its models to build R1. In June, Anthropic told lawmakers that Alibaba had systematically distilled its models to produce Qwen. Kyle Miller of the Center for Security and Emerging Technologies argues the actual competitive impact of distillation is unclear, because it enhances existing capabilities only incrementally and because Chinese labs appear capable of building frontier models independently. Mark Zuckerberg, in a blog post published the same week as the paper, characterised distillation as "an important principle of how the open source ecosystem works," warning that restricting it would disadvantage the US.

The vulnerability's significance extends beyond the distillation question. A method that bypasses alignment constraints through model-size arbitrage — using a weaker sibling to decrypt what the flagship refuses to expose — points to a structural fragility in how providers architect tiered model families. As frontier providers expand their model lineups and deploy increasingly capable agents through these same APIs, the attack surface described here is likely to grow rather than shrink.