When frontier AI models think out loud, they're supposed to keep it to themselves. New research reveals that assumption doesn't hold up against a relatively simple technique: feed encrypted reasoning traces into a smaller sibling model from the same family. The approach successfully extracted internal chain-of-thought steps from systems operated by OpenAI (GPT-5.6 Sol), Anthropic (Claude Opus 4.8), and Google before providers deployed mitigations. The vulnerability stems from how AI companies handle computation offloading. Frontier models break complex tasks into intermediate reasoning steps, but those traces contain valuable IP—providers don't want competitors using proprietary thinking as training data, and they certainly don't want users peeking at the model's private deliberations. To reduce latency, some encrypted reasoning material gets sent to the user's machine for local processing. That architectural shortcut creates an opening: smaller related models in a family share key material but often receive less rigorous alignment training than their larger siblings. By capturing an encrypted trace and feeding it to a weaker model variant, researchers could recover internal steps that should have stayed locked away. The technique wasn't limited to academic curiosity—before fixes landed, the same approach harvested sensitive information including passwords and API keys embedded in reasoning captured on users' own machines. "A security boundary built around one powerful model can fail when its smaller relatives hold compatible keys and weaker defenses," the researchers noted. Florian Tramer, a computer security researcher at ETH Zürich not involved in the study, described the model-swapping approach as technically notable and a growing concern. Alexander Panfilov of the University of Tübingen offered a more sobering assessment: some reasoning traces remain recoverable despite provider patches, and fully addressing the distillation risk would require deeper API redesign rather than surface-level fixes.

Tracing Potential Distillation Without Proving It

The research also turns this extraction method into an investigative tool. When certain open-weight models produce outputs suspiciously similar to recovered proprietary reasoning traces, it raises questions about training practices—but the researchers are careful about what their findings actually demonstrate. For 90 test prompts, they supplied open-weight systems with opening words from encrypted traces and compared continuations. Kimi K3 from Moonshot AI showed the most pronounced resemblance to both Claude Opus 4.8 and GPT-5.6 Sol outputs. DeepSeek and Thinking Machines' Inkling did not display the same pattern. Moonshot AI and Z.ai did not respond to WIRED before publication. The researchers explicitly state their results cannot causally establish distillation—similar answers are evidence worth investigating, but they don't prove what training data a developer actually used. There's also no indication that any Chinese laboratory employed this specific extraction technique during model development. What the study demonstrates is that more information could be extracted from closed models than providers intended, not who might have extracted it.

Providers Respond Differently to Disclosure

Anthropic confirmed the research did not recover encryption keys, compromise their infrastructure, or access personal data from their systems—clarifications that matter given the sensitivity around AI security claims. The company said it values independent research and is building short-term mitigations for the replay behavior. OpenAI and Google declined to comment to WIRED on the findings. All three providers adjusted their APIs in response to responsible disclosure, blocking the specific extraction method demonstrated. But Panfilov's assessment suggests the cat-and-mouse game isn't over. The core issue—shared cryptographic material across model families with inconsistent alignment strength—isn't trivially fixed without restructuring how related models handle encrypted artifacts.

Key Takeaways

  • Encrypted reasoning traces sent to users' machines for computation offloading can be replayed through smaller, less-aligned sibling models to recover internal chain-of-thought steps
  • The technique extracted sensitive information including passwords and API keys before OpenAI, Anthropic, and Google deployed mitigations
  • Kimi K3 showed striking similarity to recovered Claude Opus 4.8 and GPT-5.6 Sol traces in comparative testing, but researchers cannot prove distillation occurred
  • Full mitigation likely requires deeper API changes rather than surface patches, according to University of Tübingen's Alexander Panfilov

The Bottom Line

This research confirms what security-minded observers have suspected: model families are only as secure as their weakest link. Providers optimized for performance and cost by offloading computation to users' machines created an attack surface they didn't fully understand. Until companies treat related models as integrated systems rather than isolated endpoints, expect more findings like this one.