According to a link post by Simon Willison published on 11th August 2026, a paper hosted at the domain stolen-thoughts.com described a method for recovering the hidden reasoning of frontier language models. The post states that Anthropic, OpenAI, and Google return encrypted chain-of-thought blocks to clients that can be replayed across sessions, users, and models. The researchers reported taking a trace produced by a frontier model, replaying it into a weaker sibling model, jailbreaking that weaker model, and recovering the stronger model's hidden reasoning in plaintext. Per the paper, every model within the same family used the same encryption key, allowing the encrypted blocks to be fed back into the weakest family member. Willison notes Claude Haiku 4.5 was the easiest to attack, using a prompt instructing the model to transcribe its reasoning verbatim, combined with an assistant turn prefix that was removed in the 4.6 models. The paper also described a prompt-injection variant in which a model is tricked into including exfiltration instructions in its reasoning trace, which other models are then more likely to follow. Willison writes the attack has since been fixed: all providers acknowledged the report, after which the researchers could no longer launch the same attacks.
- Anthropic, OpenAI, and Google returned encrypted chain-of-thought blocks that could be replayed across sessions, users, and models
- Every model in a family reportedly used the same encryption key, enabling weaker siblings to decrypt stronger models' reasoning
- Claude Haiku 4.5 was cited as the easiest to attack; the exploited turn-prefix feature was removed in 4.6 models
- All providers acknowledged the report and the researchers were subsequently unable to repeat the attacks
What it means for you
Some AI models pass back 'reasoning' — their internal step-by-step working — in an encrypted form. Researchers found a way to unlock that hidden reasoning and, separately, to smuggle malicious instructions into it. The vendors have already fixed the specific holes, so there is nothing for a typical user to act on. It is a reminder that the parts of a model you cannot see are not automatically secure.
Who should care
Developers building on the OpenAI, Anthropic, or Google APIs who handle encrypted reasoning blocks, and security teams evaluating LLM providers.
Skip this if
You use AI through a chat interface or off-the-shelf tools rather than building on the raw APIs — this was a research finding, already patched, with no action required.
Sources: Simon Willison — read the original