Researchers Find Method to Unlock Hidden Reasoning in AI Models, Raising Security Concerns

Researchers have uncovered a technique that extracts the concealed reasoning processes running inside frontier AI models, uncovering vulnerabilities that affect systems from OpenAI, Anthropic, and Google. The discovery raises both security and competitive concerns in an increasingly tense landscape between US and Chinese AI development.

How the Attack Works#

The method hinges on a structural weakness: most AI providers release models of varying sizes alongside their flagship versions. Alexander Panfilov and colleagues from the University of Tübingen, Max Planck Institute, MATS Research, and Snyk discovered that by feeding encrypted reasoning traces to a smaller, less-restricted version of the same model, they could recover hidden thinking that companies normally keep secret.

Large models solve complex problems by breaking them into logical steps—what researchers call "chain of thought." While firms encrypt these reasoning chains before sending them to users, they typically provide smaller model variants with the same decryption capabilities. Since smaller models receive less alignment training, they're more likely to divulge information that their larger counterparts would refuse to reveal. As Florian Tramer, a security researcher at ETH Zürich, noted, "swapping out messages to a weaker model variant which has the same decryption key but weaker alignment is very cool"—and increasingly a liability.

A Window Into IP Theft#

The implications extend beyond data leakage. The researchers provided evidence that open-weight Chinese model Kimi K3 from Moonshot AI generates strikingly similar reasoning outputs to those from Claude Opus and GPT-5.6 Sol on certain tasks, suggesting possible knowledge transfer through "distillation"—a technique where one model learns from another's hidden capabilities.

This pattern fits into a growing geopolitical dispute. The US government has accused Chinese firms like DeepSeek and Alibaba of distilling proprietary reasoning from American models to build cheaper, competitive alternatives. However, the researchers stopped short of proving distillation occurred in Kimi K3's case, noting their work "cannot causally establish distillation."

Immediate Mitigation, Incomplete Fix#

After alerting OpenAI, Anthropic, and Google in recent weeks, each company deployed protective measures. The vulnerability that exposed passwords and API keys embedded in reasoning traces has been patched. Yet Panfilov cautioned that fully eliminating the risk would demand a fundamental redesign of how these companies' APIs function—a more drastic step than the temporary fixes already rolled out.