All three providers changed their APIs after being told about the flaw last month, Wired reports, but some reasoning traces can still be recovered.
The hidden reasoning that frontier models from OpenAI, Anthropic and Google carry out behind an API can be extracted by replaying the encrypted traces of it through a smaller version of the same model, a research team has disclosed.
Alexander Panfilov, a University of Tübingen computer scientist who took part in the study, told Wired that every leading frontier-model provider the team tested has the same weakness, and that it can spill private data while making reasoning-distillation attacks practical at scale.
The method turns the providers' own engineering against them. Powerful models break hard problems into pieces and work through them as a chain of reasoning, and firms usually keep that chain hidden for a proprietary model so nobody else can feed it into the training of a new one. To shift part of the computation off their own systems, though, they typically also pass an encrypted form of that reasoning down to the machine the user is on. Most firms put out families of models in a range of sizes, and the team found that handing those encrypted traces to a scaled-down member of the same family brings the concealed thinking into view: the smaller model has had less alignment training, so it is less likely to refuse a request to reveal what it is thinking.
The same route surfaced confidential material lodged inside reasoning traces intercepted on a user's machine, API keys and passwords among them. Florian Tramer, a computer security researcher at ETH Zürich, told Wired that handing the messages to a weaker version of a model — one using the identical decryption key while being less tightly aligned — was extremely clever, and said the matter is definitely becoming a problem.
Hidden reasoning is exactly what a distillation attack would be after, so the team next ran the technique as a test rather than an attack: 90 questions put to every model, to see whether open-weight systems had already distilled from closed ones. Supplied with the opening handful of words from reasoning traces taken off the proprietary systems, some open models at times produced strikingly close answers. The effect stood out most with Kimi K3, the open-weight Chinese model built by Moonshot AI, whose output closely matched the concealed traces of Claude Opus 4.8 and GPT 5.6 Sol on some prompts.
The researchers stop short of a conclusion: they said their study cannot pin distillation down as the cause, and two other open-weight systems — DeepSeek, out of China, and Inkling, made by the American firm Thinking Machines — showed no such resemblance in their reasoning to Claude Opus. Nothing points to AI firms in China having used this particular method. Moonshot AI had not answered Wired's request for comment as of publication.
Panfilov and his coauthors notified OpenAI, Anthropic and Google last month, and all three have since altered their APIs to blunt the issue. Anthropic spokesperson Michael Aciman told Wired that the company places value on outside researchers scrutinizing its models and has started assembling near-term fixes aimed at the replay behavior the report sets out; he added that the work involved no recovery of encryption keys, no entry into the company's infrastructure and no retrieval of personal data held on Anthropic's systems. Google and OpenAI declined to comment to the magazine.
The changes close part of the hole. Private data can no longer be pulled out this way, Panfilov told Wired, but certain reasoning traces can still be surfaced by the same technique, and fully fixing the distillation vulnerability would require a fundamental overhaul of how these companies' APIs work.