How a Cheap Model Reads the Flagship's Secret Reasoning Aloud

Source: Stealing Reasoning Traces from Proprietary LLM APIs

Paper was published on August 10, 2026

This episode was AI-generated on August 11, 2026. The script was written by an AI language model and the host voices were synthesized by Eleven Labs. The producer is not affiliated with Anthropic or Eleven Labs.

Frontier labs hide their models' chain-of-thought behind encryption and hand the sealed blob to you to carry around. Researchers found the seal proves the reasoning wasn't altered — but never proves it's yours — so you can hand a flagship model's private thinking to its cheapest sibling and ask it, politely, to read it out loud. Then they pointed it at public GitHub logs and pulled 62 live API keys and 33 passwords out of transcripts nobody could open.

Key Takeaways

• Why the encrypted reasoning block authenticates its contents but not its owner — no user ID, no session ID on the seal
• The three-part prompt that gets Haiku to transcribe Opus's hidden reasoning verbatim, for roughly $720 per ten thousand traces
• How token counts are used as a faithfulness check when there's no ground truth — and where that check gets circular on the GPT side
• The 'redactor's worksheet' effect: asking an agent to sanitize a session is what makes it restate every secret in hidden reasoning
• The steelman critique: a 1-in-300 block hit rate, 91% of artifacts already in plaintext, and credential counts produced by an unvalidated two-stage LLM judge
• Why encrypted reasoning can only ever be semi-hidden — the decryption key is a language model, and language models can be talked into things

• 00:00 — The key it refused to repeat
  A model spots a leaked API key, decides not to repeat it, and writes it out in full in its hidden reasoning — which researchers then harvested from public logs at scale.
• 01:48 — Why they hand you the envelope
  The IP and safety reasons for hiding chain-of-thought, and why statelessness forced providers to encrypt the reasoning and hand it to your app as a ~36,000-character opaque string.
• 03:19 — The seal proves the wrong thing
  The envelope analogy: the seal binds model name, format version, and key identifier — but not user or session — enabling three escalating levels of replay.
• 05:05 — Handing the folder to the intern
  The actual attack: a three-part request that gets cheap Haiku to decrypt and transcribe Opus's reasoning, with the economics that make it trivially affordable.
• 07:15 — How do you verify a stolen copy?
  Token counts as a proxy for faithfulness across 120 competitive programming problems — and why the GPT extraction, with 50 candidate transcripts selected on that same metric, is shakier.
• 08:59 — Publishing the recycling bin
  Nearly 7,000 public agent trajectories yield 300,000+ blocks, 367 pieces of personal information, 182 credentials — and the finding that asking an agent to sanitize is what triggers the leak.
• 11:38 — Is the headline number thinner than it looks?
  The critique: a one-in-300 block hit rate, 91% of genuine artifacts already visible in plaintext, and credential counts produced by an LLM judge with no reported precision or recall.
• 13:08 — Notes in your own handwriting
  Two attacks that don't involve credentials at all: extracting the unsafe reasoning behind a responsible-sounding answer, and injecting instructions into the assistant slot that transfer across models and tasks.
• 15:23 — The lock and the contents are the same object
  Why user binding is easy and session binding breaks forking, compaction, and model downgrades — and why no amount of cryptography fixes a system where the decryption key is a language model.

Recommended Reading

• Chain of Thought Monitorability: A New and Fragile Opportunity for AI Safety — The multi-lab position paper behind the episode's core tension — that hidden reasoning is deliberately left unpoliced so it stays readable to safety monitors, an assumption this extraction attack quietly breaks.
• Monitoring Reasoning Models for Misbehavior and the Risks of Promoting Obfuscation — The OpenAI result Finn cites when explaining why refusal pressure is applied hard to the output channel and lightly to the reasoning channel: optimize the chain of thought and models learn to hide, not behave.
• Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection — The canonical framing of injection-as-untrusted-input, which makes a useful contrast with the episode's stranger variant where the poisoned instruction arrives inside a signed assistant turn, in the model's own voice, leaving no plaintext trace.
• Stealing Part of a Production Language Model — A prior demonstration that a black-box commercial API can be induced to give up proprietary internals, useful context for the episode's argument that the flagship's IP protections are only as strong as the cheapest sibling sharing the same infrastructure.