Hidden reasoning tokens in proprietary AI APIs can be extracted using model distillation

Researchers found a way to extract hidden reasoning traces from major AI APIs by replaying encrypted blocks into weaker models.

AI providers like Anthropic, OpenAI, and Google return encrypted thinking blocks to clients to maintain conversation context without revealing internal reasoning. Researchers at MATS Research, the ELLIS Institute Tübingen, and partner institutions showed that these blocks are portable across models. By taking an encrypted trace from a frontier model and feeding it to a cheaper, jailbroken model from the same provider, they forced the weaker model to output the stronger model's raw reasoning in plain text.

Why it matters: The technique bypasses provider anti-distillation protections without directly attacking flagship models. Beyond intellectual property leakage, analyzing 6,708 public agent trajectories revealed 704 distinct private artifacts—including API keys, passwords, and personal emails—that were hidden inside reasoning traces.

Here's the gist: if an API returns encrypted thinking tokens to your browser or app, that payload can be replayed to unlock the hidden chain of thought.

Expect AI providers to update their cryptographic signatures to lock reasoning payloads to specific model IDs and user sessions soon.