Researchers Expose Hidden AI Model Reasoning in New Security Study

Researchers have discovered a vulnerability that can expose hidden AI model reasoning from leading systems developed by OpenAI, Anthropic and Google.

The research was conducted by scientists from the University of Tübingen, the Max Planck Institute, MATS Research and cybersecurity company Snyk. Their findings show that encrypted reasoning traces returned by some AI APIs can potentially be recovered and converted back into readable text.

The discovery raises concerns about the protection of proprietary model reasoning, private information and the possibility of using extracted reasoning to improve competing AI systems.

How the Vulnerability Works

Reasoning models can generate internal chains of reasoning before producing a final response. AI providers generally conceal these traces from users.

According to the researchers, however, the encrypted reasoning blocks sent through APIs can be compatible across different sessions and models within the same provider’s ecosystem.

The researchers found that a reasoning trace from a more capable model could be supplied to a weaker, less protected model from the same provider, which could then be induced to decode and reproduce the hidden reasoning in plain text.

This creates a potential pathway for extracting proprietary reasoning without directly bypassing the security protections of the original model.

Large-Scale Privacy Risks

The security implications extend beyond intellectual property.

The researchers examined 315,320 reasoning blocks collected from publicly available repositories. Their analysis recovered 367 personally identifiable information artifacts and 182 credentials from those encrypted blocks.

The finding highlights a potentially serious problem for developers who publish raw AI session logs without realizing that apparently protected reasoning data could contain information that becomes readable through the researchers’ technique.

The study also found that hidden reasoning can contain sensitive or hazardous information that does not appear in a model’s final response.

Kimi K3 Raises Distillation Questions

The research also adds a new technical dimension to the ongoing debate over AI model distillation.

The researchers compared extracted reasoning from leading proprietary systems with several open-weight models. They found that Moonshot AI’s Kimi K3 displayed unusually strong similarities to reasoning traces associated with Claude Opus 4.8 and GPT 5.6 Sol for certain prompts.

This could be consistent with reasoning distillation, where one model learns from the behaviour or outputs of another.

However, the researchers explicitly caution that their findings do not causally establish that Kimi K3 was distilled from these models.

The comparison is also significant because DeepSeek and Thinking Machines’ Inkling did not show the same pattern of similarity with Claude Opus, according to the study.

Other Security Risks Discovered

The researchers identified additional problems involving hidden reasoning.

Because encrypted reasoning blocks can potentially be manipulated and replayed, the vulnerability could also enable invisible prompt injections. Malicious instructions could potentially be embedded inside reasoning blocks without appearing in the visible conversation.

The study therefore presents the issue as more than a model-theft problem. It potentially affects privacy, security, AI safety and the integrity of agentic systems.

AI Companies Respond

The researchers disclosed the vulnerability to OpenAI, Anthropic and Google.

All three companies subsequently changed their APIs to reduce the risks identified by the researchers. Private-information extraction using the reported approach has been mitigated, although the researchers say some reasoning traces can still be recovered.

The researchers argue that completely eliminating the possibility of reasoning distillation would require more fundamental changes to the way AI APIs handle encrypted reasoning information.

Why AI Model Reasoning Matters

The findings highlight a difficult trade-off for AI developers.

Hidden reasoning is intended to protect intellectual property, prevent sensitive information from being exposed and reduce opportunities for competitors to copy model behaviour. But the same mechanisms can create security risks if encrypted information is returned to clients and later stored or exposed.

The research suggests that protecting AI model reasoning requires more than simply hiding the text from the user interface. The underlying architecture used to transport and store reasoning traces also matters.

Frequently Asked Questions

What is AI model reasoning?

AI model reasoning refers to the intermediate processing a reasoning model performs before generating its final response.

Can hidden AI reasoning be extracted?

Researchers demonstrated a technique that can recover hidden reasoning traces from APIs operated by OpenAI, Anthropic and Google.

Does the research prove Kimi K3 copied Claude?

No. The researchers found unusual similarities but did not establish a causal link proving that Kimi K3 was trained through distillation.

Did the AI companies fix the vulnerability?

OpenAI, Anthropic and Google implemented mitigations after researchers disclosed the vulnerability, although some reasoning traces may still be recoverable.

Conclusion

The new research exposes important weaknesses in how AI model reasoning is protected through modern APIs. The ability to recover hidden reasoning creates risks involving proprietary technology, private information, credentials, hazardous content and prompt injection.

The Kimi K3 findings also intensify the debate over AI distillation, but they should not be interpreted as definitive proof that Moonshot AI copied reasoning from American models.

More broadly, the study demonstrates that protecting hidden AI reasoning requires careful consideration of the underlying API architecture, not simply keeping reasoning invisible to end users.