--- title: CoT Fully Exposed?! The Worst AI Exploit That Almost... description: A newly disclosed exploit shows how encrypted reasoning traces returned by stateless reasoning-model APIs (used so providers don't have to store conversation... canonical: https://daily.dev/posts/cot-fully-exposed-the-worst-ai-exploit-that-almost-happened-jssimwzrj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: CoT Fully Exposed?! The Worst AI Exploit That Almost Happened | daily.dev og:description: A newly disclosed exploit shows how encrypted reasoning traces returned by stateless reasoning-model APIs (used so providers don't have to store conversation... og:url: https://daily.dev/posts/cot-fully-exposed-the-worst-ai-exploit-that-almost-happened-jssimwzrj og:image: https://api.daily.dev/og/posts/jSsImWzRJ.png og:image:alt: CoT Fully Exposed?! The Worst AI Exploit That Almost Happened og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # CoT Fully Exposed?! The Worst AI Exploit That Almost Happened **[bycloud](https://daily.dev/sources/bycloud)** · 15 min read · 1 upvotes · 0 comments ## Summary A newly disclosed exploit shows how encrypted reasoning traces returned by stateless reasoning-model APIs (used so providers don't have to store conversation state) can be moved between conversations, accounts, and even different models. Researcher Matthew Green first found these encrypted blobs were portable and could leak information like social security numbers when replayed. A follow-up paper, 'Stealing Reasoning Traces from Proprietary LLM APIs,' goes further: an encrypted reasoning blob from a stronger model like Opus 4.8 can be passed to a weaker, less safety-hardened model like Haiku 4.5, which can be jailbroken into transcribing the hidden reasoning in plain text. Across 120 Codeforces problems, recovered trace lengths matched reported thinking-token counts, suggesting the extraction is close to the real chain of thought. The technique also let researchers compare reasoning styles across model families (Kimi K3, GLM 5.2, GPT-5.6, Claude) and found Kimi K3 unusually likely to continue Claude's reasoning traces, though this falls short of proving distillation. It also exposed harmful reasoning content that models had internally considered but refused to state, and enables a thought-injection attack variant. Providers were notified and the exploit is reportedly already patched, likely via encryption binding tying a trace to the same model, user, and conversation. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did researchers manage to extract hidden chain-of-thought reasoning from encrypted API responses like OpenAI's and Anthropic's? Reasoning models return encrypted reasoning blobs to clients so stateless APIs can reuse them in later turns, but these blobs were found to be portable across sessions, accounts, and even different models. Researchers passed a stronger model's encrypted reasoning signature, such as one from Claude Opus 4.8, into a weaker model like Haiku 4.5, then jailbroke that weaker model into transcribing the reasoning into plain text. _Teams relying on reasoning-model APIs can follow security disclosures like this one through daily.dev to catch similar exploits early._ ### How did Matthew Green discover that encrypted reasoning traces in LLM APIs could be replayed across sessions? In May, security researcher Matthew Green found that although encrypted reasoning blocks from LLM APIs could not be decrypted by users, they could still be moved and replayed into different conversations, accounts, or even different models. In one experiment, a reasoning block containing a social security number was moved into a separate session on another account, and that sensitive information leaked into the new session's output. _Developers building on reasoning APIs can track findings like Green's to understand what data their chain-of-thought handling exposes._ ### Does Kimi K3 show evidence of being trained on Claude or GPT reasoning traces? Kimi K3 was 10,000 to 1 million times more likely than models like DeepSeek V4 Flash or Inkling to reproduce the next 16 tokens of a decoded Claude reasoning trace, and its reasoning style drifted toward Claude's after receiving just a small prefix. Even so, the absolute probability remained extremely low, requiring around 10 billion queries on average to match 16 tokens, so this does not prove verbatim memorization or confirm distillation. _Anyone evaluating claims about model distillation can weigh evidence like this via daily.dev before drawing conclusions._ ## Similar posts on daily.dev - [Schneier on Security](https://daily.dev/posts/schneier-on-security-bkhfug2oz) · Schneier on Security · 3 upvotes · 0 comments - [Chain-of-Thought Faithfulness: Toggling 'Reasoning Mode' Made One Model 5x More Likely to Follow Its Own Mistakes](https://daily.dev/posts/chain-of-thought-faithfulness-toggling-reasoning-mode-made-one-model-5x-more-likely-to-follow-its-o0hlw57ed) · DEV · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#machine-learning](https://daily.dev/tags/machine-learning), [#anthropic](https://daily.dev/tags/anthropic), [#prompt-engineering](https://daily.dev/tags/prompt-engineering), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/cot-fully-exposed-the-worst-ai-exploit-that-almost-happened-jssimwzrj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"CoT Fully Exposed?! The Worst AI Exploit That Almost Happened","url":"https://daily.dev/posts/cot-fully-exposed-the-worst-ai-exploit-that-almost-happened-jssimwzrj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cot-fully-exposed-the-worst-ai-exploit-that-almost-happened-jssimwzrj"},"datePublished":"2026-08-24T19:43:05.576Z","dateModified":"2026-09-13T19:09:06.471Z","description":"A newly disclosed exploit shows how encrypted reasoning traces returned by stateless reasoning-model APIs (used so providers don't have to store conversation...","image":"https://i.ytimg.com/vi/rtYTguPItDE/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/rtYTguPItDE/sddefault.jpg","isAccessibleForFree":true,"articleSection":"bycloud","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"bycloud","logo":"https://media.daily.dev/image/upload/s--UUgAibgb--/f_auto/v1712315122/logos/bycloud","url":"https://daily.dev/sources/bycloud"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cot-fully-exposed-the-worst-ai-exploit-that-almost-happened-jssimwzrj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,machine-learning,anthropic,prompt-engineering,prompt-injection","timeRequired":"PT15M","video":{"@type":"VideoObject","name":"CoT Fully Exposed?! The Worst AI Exploit That Almost Happened","description":"A newly disclosed exploit shows how encrypted reasoning traces returned by stateless reasoning-model APIs (used so providers don't have to store conversation...","thumbnailUrl":"https://i.ytimg.com/vi/rtYTguPItDE/sddefault.jpg","uploadDate":"2026-08-24T19:43:05.576Z","duration":"PT15M","url":"https://api.daily.dev/r/jSsImWzRJ","embedUrl":"https://www.youtube.com/embed/rtYTguPItDE"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"bycloud","item":"https://daily.dev/sources/bycloud"},{"@type":"ListItem","position":3,"name":"CoT Fully Exposed?! The Worst AI Exploit That Almost Happened"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/cot-fully-exposed-the-worst-ai-exploit-that-almost-happened-jssimwzrj#faq","mainEntity":[{"@type":"Question","name":"How did researchers manage to extract hidden chain-of-thought reasoning from encrypted API responses like OpenAI's and Anthropic's?","acceptedAnswer":{"@type":"Answer","text":"Reasoning models return encrypted reasoning blobs to clients so stateless APIs can reuse them in later turns, but these blobs were found to be portable across sessions, accounts, and even different models. Researchers passed a stronger model's encrypted reasoning signature, such as one from Claude Opus 4.8, into a weaker model like Haiku 4.5, then jailbroke that weaker model into transcribing the reasoning into plain text. Teams relying on reasoning-model APIs can follow security disclosures like this one through daily.dev to catch similar exploits early."}},{"@type":"Question","name":"How did Matthew Green discover that encrypted reasoning traces in LLM APIs could be replayed across sessions?","acceptedAnswer":{"@type":"Answer","text":"In May, security researcher Matthew Green found that although encrypted reasoning blocks from LLM APIs could not be decrypted by users, they could still be moved and replayed into different conversations, accounts, or even different models. In one experiment, a reasoning block containing a social security number was moved into a separate session on another account, and that sensitive information leaked into the new session's output. Developers building on reasoning APIs can track findings like Green's to understand what data their chain-of-thought handling exposes."}},{"@type":"Question","name":"Does Kimi K3 show evidence of being trained on Claude or GPT reasoning traces?","acceptedAnswer":{"@type":"Answer","text":"Kimi K3 was 10,000 to 1 million times more likely than models like DeepSeek V4 Flash or Inkling to reproduce the next 16 tokens of a decoded Claude reasoning trace, and its reasoning style drifted toward Claude's after receiving just a small prefix. Even so, the absolute probability remained extremely low, requiring around 10 billion queries on average to match 16 tokens, so this does not prove verbatim memorization or confirm distillation. Anyone evaluating claims about model distillation can weigh evidence like this via daily.dev before drawing conclusions."}}]} ```