A new research finding shows that some frontier AI models may reveal more of their hidden reasoning than their developers intended. The discovery matters because those reasoning traces can contain valuable information about how a model solves hard problems, and in some cases they were shown to expose sensitive data such as passwords and API keys.
What the researchers found
Alexander Panfilov, a computer scientist at University of Tübingen in Germany, worked with colleagues from the University of Tubingen, the Max Planck Institute, the AI safety institute MATS Research, and the security company Snyk. The group identified the same issue with frontier models from OpenAI, Anthropic, and Google when those models were accessed through an application programming interface, or API.
The problem centers on hidden reasoning traces. Advanced AI systems often work through complex tasks by breaking them into smaller steps, a process commonly described as chain of thought. Companies generally keep this reasoning private, partly because it can reveal how the model works and partly because it could be used to train another model.
The researchers found that encrypted reasoning sent to a user’s computer could be fed into a smaller version of the same model family. Because those smaller models had received less alignment training, they were more likely to reveal the hidden reasoning rather than refuse.
Panfilov described the risk directly: "It can lead to personal information leakage, and it enables large-scale reasoning distillation attacks."
Why smaller models matter
The attack depends on how major AI companies offer related models of different sizes. Larger models are more capable, but they are also more computationally expensive to run and cost more to access. Smaller models are cheaper and weaker, which makes them useful for some tasks but also creates a security gap in this case.
The researchers’ method used that gap. If a smaller model variant can process the same encrypted reasoning but has weaker safeguards, it may reveal material that the larger model would keep hidden.
Florian Tramer, a computer scientist at ETH Zürich in Switzerland who focuses on computer security, said the approach was notable. "The idea of swapping out messages to a weaker model variant which has the same decryption key but weaker alignment is very cool," he said. "Its definitely becoming an issue."
The same method also showed that secret information, including API keys and passwords, could be embedded in reasoning traces captured from a user’s machine. Panfilov and coauthors alerted OpenAI, Anthropic, and Google to the vulnerability last month, and each company adjusted its API to mitigate the issue.
The link to distillation
The research also enters a larger debate about AI model distillation. Distillation is a common technique for copying capabilities from one model into another more efficiently. It is especially common in the development of open-weight or fully downloadable models.
The controversy is about whether some companies are using distillation to copy the best closed models. The researchers say their method could make it possible to extract more reasoning information from closed models than previously understood, but they do not say that Chinese AI companies used this specific technique.
In their paper, the researchers compared hidden reasoning traces from proprietary models with outputs from open-weight models. They found that Kimi K3 from Moonshot AI produced strikingly similar output to the hidden reasoning traces of Claude Opus 4.8 and GPT 5.6 Sol for certain prompts.
The researchers were careful about what that means. They wrote that the work "cannot causally establish distillation." They also found that China’s DeepSeek and Inkling from the US company Thinking Machines did not show the same kind of reasoning similarity with Claude Opus.
What companies and researchers said
Moonshot AI and Z.ai did not respond to a request for comment by time of publication. Google and OpenAI both declined to comment.
Michael Aciman, a spokesperson for Anthropic, said the company values independent research and has started short-term mitigations for the replay behaviors described in the report. He also said the research did not involve recovering encryption keys, accessing Anthropic’s infrastructure, or recovering personal data from its systems.
Panfilov said the API changes mean private information can no longer be extracted in this way. However, he also said some reasoning traces can still be uncovered with the same method. Fully addressing distillation through this channel would require a deeper change to how these companies’ APIs operate, according to him.
The policy stakes
The findings land during a broader argument about whether distillation helps Chinese AI companies compete with US firms. OpenAI told US lawmakers in February that DeekSeek appeared to have copied one of its models to build a reasoning model called R1. In June, Anthropic told lawmakers that Alibaba had systematically distilled its models to build Qwen.
Not everyone agrees on how much this matters. Kyle Miller, a researcher at the Center for Security and Emerging Technologies (CSET), said it remains unclear how much distillation benefits China. He argued that Chinese companies appear able to build cutting-edge models from scratch if needed.
Yarin Gal, a computer scientist at Oxford University, pointed to the other side of the debate. Distillation is widely used and has helped AI progress more quickly, he said. "If it's the norm that everyone blocks everyone [from doing distillation], then that also will have implications on the rate of progress," he said.
The immediate lesson is narrower but important. Hidden reasoning is not always as hidden as model providers and users may assume. Even after mitigations, frontier AI systems may still expose parts of their internal reasoning in ways that complicate security, competition, and policy.