What's this about?
Researchers (MATS / ELLIS Tübingen / Max Planck) show that the encrypted "reasoning" blocks that Anthropic, OpenAI, and Google hand back to API clients aren't really safe. Those encrypted chain-of-thought blocks can be replayed across sessions, users, and models. The attack: take an encrypted trace from a strong frontier model, replay it into a weaker sibling model, jailbreak the weaker one, and recover the strong model's hidden reasoning in plaintext — never attacking the strong model directly and never tripping its anti-distillation defenses.
What exactly is a "reasoning trace"?
Modern reasoning models "think" before answering — they generate a long internal scratchpad of steps. Labs usually hide this scratchpad from users (to protect their secret sauce and to prevent competitors from copying it) and return it only as an encrypted blob you can pass back in follow-up calls. This paper shows that blob is a leak: the hidden thinking can be pulled back out, so the "encryption" protects far less than assumed.
What's the community saying?
- The demo pages are wild: the site literally shows recovered scratchpads — models arguing through Codeforces problems, revealing April Fools puzzle answers, and drifting during jailbreaks.
- Anti-distillation is porous: commenters note this undercuts the whole premise of hiding CoT to stop rivals from distilling your model.
- Cross-model replay is the scary part: the trick of laundering a strong model's reasoning *through* a weaker sibling is what makes it hard to defend.
- Naming: the "stolen-thoughts.com" branding and dice-roll author ordering got their own appreciation subthread.