A research team (stolen-thoughts.com, arXiv 2608.09867) demonstrates that hidden chain-of-thought reasoning traces from proprietary LLM APIs — Anthropic, OpenAI, Google — can be recovered with near-perfect fidelity. They ran a decoding pipeline on 6,708 public agent trajectories from GitHub and Hugging Face that still contained encrypted reasoning blocks, reconstructing 315,320 reasoning blocks whose token count closely tracks the hidden thinking-token count reported by the API.
The privacy finding is the real story:
- 704 distinct privacy artifacts recovered from genuine (non-benchmark) user sessions: 62 API keys, 33 passwords, 24 access tokens, 30 personal email addresses, plus names, addresses, and internal URLs
- 64 of those 704 artifacts appeared exclusively inside the reasoning blocks — nowhere in the visible session output
- The recovered traces include hazardous knowledge from misuse-uplift jailbreaking (e.g., car theft vulnerabilities) that the model’s visible answer intentionally suppresses
The site also demonstrates three attack variants: prefilling Kimi-K3’s reasoning with 1% of Opus 4.8’s trace shifts its answer toward Opus’s wording; API summaries can mask “answer-before-derivation” patterns in reasoning; and encrypted reasoning blocks in public agent repos remain recoverable.
The implication is that “hidden” reasoning is a transparency fiction — if the model receives the full thinking as input context or the API leaks token counts, the trace is extractable. For anyone deploying coding agents or monitoring model outputs, this means the reasoning trace is part of the security surface, not an implementation detail.