Researchers crack hidden reasoning across OpenAI, Anthropic, and Google APIs
MATS Program researchers just exposed a vulnerability across OpenAI, Anthropic, and Google APIs that lets users extract hidden thinking tokens from frontier models. The encrypted reasoning blobs were fully portable across models and leaked dozens of API keys. All three AI labs have begun rolling out patches.
AI labs treat the internal reasoning of their flagship models like a trade secret. Now, researchers have found a way to read those hidden thoughts word for word.
Reading Opus's mind with Haiku
Researchers at the MATS Program uncovered an API vulnerability affecting OpenAI, Google, and Anthropic that allows the extraction of hidden reasoning tokens from Claude, GPT, and Gemini models.
According to researcher @kotekjedi_ml, the extracted token counts matched the billed thinking tokens on the API one-to-one for most queries tested.
The real shocker is portability. These encrypted reasoning blobs can be transferred across sessions, accounts, and even different models. In practice, researchers managed to jailbreak Claude Haiku 4.5 to make it read the internal reasoning trace generated by Opus 4.8.
The security fallout is already visible. A scan of 7,000 public traces revealed 62 leaked API keys, 33 email addresses, and 33 plaintext passwords. The affected labs have started rolling out patches following responsible disclosure.
Why it matters
Frontier AI companies hide chain-of-thought tokens for two reasons: safety and protecting their proprietary secret sauce from distillation. If a cheap, fast model can be used to unpack the reasoning of a top-tier frontier model, that economic moat collapses overnight.
For developers, it is a wake-up call that hidden reasoning is not a secure sandbox. We think engineering teams need to stop trusting models to keep secrets, because prompt data and credentials injected into reasoning workflows can easily slip through cracks in API state management.
Sources (1)
- x.com(opens in a new tab)Originalx.com