Modern AI models generate extensive internal reasoning before providing final answers. This "thinking" process contains intermediate hypotheses, tool outputs, and user data, making it significantly denser than the polished output. Most major providers withhold this trace for two reasons: commercially, competitors could use it to train cheaper imitations, and technically, exposing full reasoning could reveal sensitive user information.

In August 2026, researchers from MATS Research, the ELLIS Institute Tübingen, and the Max Planck Institute for Intelligent Systems demonstrated a vulnerability. They showed that encrypted reasoning blocks provided by Anthropic, OpenAI, and Google could be replayed into a cheaper model within the same family. When replayed, the cheaper model prints the hidden reasoning in plaintext, effectively stealing the original model's thoughts.

The extraction method involves forcing the cheaper model to generate the full chain of thought. Verification confirmed that the replayed output matched the original hidden process. This vulnerability impacts multiple providers, revealing that current encryption methods for reasoning blocks are insufficient.

The researchers identified four primary attack vectors enabling this replay. A scan of published session logs confirmed the prevalence of this issue. Proposed fixes involve modifying the replay mechanism, though a fundamental limit remains regarding how much reasoning can be truly protected while maintaining model utility.

The findings highlight a critical gap in AI privacy, showing that encrypted blocks do not guarantee confidentiality against determined replay attacks. This poses significant risks for applications handling sensitive data, as hidden thoughts can be extracted and exposed. The research underscores the need for stronger architectural safeguards in future model designs to prevent unauthorized reasoning extraction.