Independent Researchers Find Way to Fully Restore Hidden Reasoning of Frontier Models
Researchers have discovered a vulnerability in frontier AI models that allows for the recovery of encrypted reasoning without jailbreaking. This could have serious implications for data security.
Independent Researchers Find Way to Fully Restore Hidden Reasoning of Frontier Models
The article shows that the encrypted reasoning of any OpenAI, Anthropic, and Google model can be decoded literally 1:1, without jailbreaking the model.
The authors found an architectural flaw: encrypted reasoning blocks are fully compatible and interchangeable between different sessions, users, and models within the ecosystem of a single provider. For example, if you take the encrypted reasoning of Opus and feed it to the less intelligent Haiku, it can read these "thoughts" and output them verbatim in plain text. It's that simple.
Consequences
- This vulnerability allows for the circumvention of anti-distillation measures.
- There are many such hidden reasoning blocks in open repositories that may contain sensitive data (the article found 367 PII artifacts and 182 accounts in a sample of 315,320 blocks).
- It simplifies jailbreaks and prompt injections.
Researchers have already passed their findings to labs and report that work on them is ongoing.
Why it matters
AnalysisThis vulnerability could lead to serious threats to data security in AI models used across various sectors. Timely detection and remediation of such issues are crucial for protecting sensitive information.
Discuss in community
Share your questions and insights with developers
Related in Ecosystem
Practical guides, core terminology, and agent skills
Binance publishes investigation into $6.3 billion theft
Binance’s investigation links the theft to a modified Homebrew download, a fake interview and abuse of an internal AI tool.
MIT researchers show GPT-6 Astra can improve other AI models by editing their weights
In an experiment, Astra raised Qwen3.5-0.8B's accuracy on MATH-500 from 7.9% to 48.1% by changing only 0.016% of the model's weights.
Part II. How to Work with Codex + Optimization/Security/Team
Codex is not just code autocomplete in a chat; it is a full-fledged engineering agent: it reads the repository, plans changes, edits files, runs tests, reviews its own diffs, and c...
How to Make AI Agents Safe: Stop Rules, Human Approval, and Sandboxes
An agent in production is a process that can write files, make API calls, change data, and consume tokens autonomously, without pausing and without your involvement at every step.