A Weaker AI Model Can Read a Stronger One's Hidden Reasoning, Researchers Say
A Research Team Says It Found a Way to Peek Inside AI Models' 'Private' Thinking
Major AI providers, including OpenAI, Anthropic, and Google, have long presented the internal 'thinking' or reasoning steps of their most advanced models as encrypted or otherwise opaque to users. This design choice is meant to protect proprietary reasoning methods while still letting people benefit from the results. A newly circulated research paper argues that this sealed-off reasoning may not be as protected as assumed. According to the paper's authors, encrypted reasoning objects generated by these systems can, in certain conditions, be reconstructed by other models entirely.
The researchers describe working with a large dataset: 6,708 public agent trajectories, from which they say they decoded 315,320 individual 'thinking blocks.' It is worth emphasizing that this is a claim from a specific academic paper, not a disclosure or confirmation from any of the AI vendors named. As with any single research effort, its findings should be understood as reported results awaiting broader scrutiny rather than settled fact.
How a Weaker Model Becomes a 'Fuzzy Decoder' of a Stronger One
The mechanism described in the paper is notable for its relative simplicity. Researchers reportedly used comparatively weaker models, specifically identified as Claude Haiku 4.5, GPT-5.6 Luna, and Gemini Robotics ER-1.6, to reconstruct the hidden reasoning content of stronger, more capable models made by the same provider. The paper's authors refer to this technique as using a weaker model as a 'fuzzy decoder.'
A key detail here is scope: the researchers indicate this approach appeared to work within a provider's own family of models, not across different companies' systems. In other words, the claim is not that Anthropic's models can decode OpenAI's reasoning, or vice versa, but that a provider's own smaller or older models may share enough underlying structure with their larger counterparts to make this kind of reconstruction possible.
Importantly, the researchers themselves caution that they lack what they call 'ground-truth plaintext' — meaning they cannot definitively prove the decoded content is an exact match to the original hidden reasoning. Their own framing suggests the recovered material is approximate and inferred, not a verified, byte-for-byte reproduction. This is a meaningful caveat that tempers the strength of the paper's conclusions.
What the Paper Says Was Recovered From Real User Sessions
According to the research, the decoding process surfaced 704 distinct items the authors describe as privacy artifacts, drawn from what they characterize as genuine user sessions. The reported breakdown includes 62 API keys, 33 passwords, 24 access tokens, and seven private keys. If accurate, this would represent a meaningful exposure of sensitive material embedded in reasoning traces rather than in the visible output most users typically see.
One detail that has drawn particular attention is the claim that 64 of these 704 artifacts appeared only within the hidden reasoning content, and were not present anywhere in the visible or sanitized traces that platforms typically show or log for review. Many observers note that, if this holds up, it would suggest that simply redacting or cleaning visible output logs is not sufficient to guarantee that sensitive information hasn't leaked elsewhere in a system's processing. This is a possibility worth taking seriously, though it remains a claim from one research group rather than an independently verified, vendor-confirmed fact.
Disclosure, Response, and Notable Vendor Silence
The paper's authors say they disclosed their findings to OpenAI, Anthropic, Google, Microsoft, and Hugging Face prior to publication, consistent with common responsible-disclosure practice in security research. According to the researchers, as of the reporting window in August 2026, the primary extraction technique they used was no longer reproducible. It's important to note this claim comes from the researchers themselves, not from confirmation by any of the named vendors.
The paper also reportedly notes that Anthropic updated some of its guidance following the disclosure. However, none of the named companies appears to have issued a public security advisory or formal acknowledgment of the specific vulnerability described. This absence of public vendor confirmation is a recurring concern raised by those following the story, and it leaves open questions about the current status of any fix, as well as whether previously published, already-decoded reasoning blocks remain accessible or exploitable.
Why This Matters — and Why It's Not the Whole Picture
Some important context tempers the scope of these findings. The dataset analyzed reportedly comes from one identifiable source of public agent trajectories, not a comprehensive sample of all API users or all possible deployment contexts. This means the findings, while notable, describe a bounded slice of real-world usage rather than the entire ecosystem.
It is also worth stating plainly: there is no claim, in the paper or in secondary coverage, of in-the-wild exploitation of this technique by malicious actors. The research appears to be an academic demonstration of a possibility, not a report of an active, ongoing attack campaign.
More broadly, this research raises a conceptual question that many in the AI safety and security community consider significant: opaque reasoning is not necessarily the same thing as secure reasoning. Encrypting or hiding a model's internal steps from end users may create an impression of confidentiality that doesn't fully hold up under the kind of cross-model analysis described in this paper.
Secondary coverage and commentary, including from technology publications and independent security researchers, has generally engaged with and discussed the paper's core claims. A recurring theme in this secondary coverage is an acknowledgment that the findings are noteworthy while also flagging that independent, ground-truth verification of the decoded content has not been established. As with the original paper, this is an area where continued scrutiny and, ideally, direct vendor engagement would help clarify the actual scope and current status of the issue.