What's this about?
The researchers behind the reasoning-trace extraction work went public. Alexander Panfilov and colleagues say they found a vulnerability present in the APIs of *every* frontier AI company that lets them extract models' hidden reasoning. Their evidence for the claim is precise: the number of reasoning tokens they recover matches the thinking tokens the API bills you for, 1:1, across most prompts they tested. swyx called it "already one of the most important papers of this year" and published his own distillation because the paper's methodology wasn't clearly explained.
What exactly is a "reasoning trace"?
When a modern model answers a hard question, it first thinks step by step in a private scratchpad before writing its reply. That scratchpad is the reasoning trace. Labs deliberately hide it — partly so competitors can't train cheap copies on it (distillation), partly because unfiltered intermediate thinking can be ugly or wrong. You are, however, billed for those hidden tokens. The finding is that the trace can be reconstructed anyway, which means the "hidden" part was a business boundary rather than a technical one.
What's the community saying?
- The 1:1 token verification is what convinced people. Rather than claiming a plausible-looking reconstruction, the authors anchored it to the provider's own billing meter, which is very hard to argue with.
- The methodology gap became its own story. swyx's complaint that the paper doesn't clearly explain how it works — and his decision to write a distillation — was itself widely shared, and points at how fast this moved from preprint to headline.
- It reframes an alignment debate as a security one. Chain-of-thought monitoring is a pillar of current safety plans, and it assumes labs control who can see the reasoning. Yesterday's related work showed encrypted traces can be replayed across models; together they suggest that assumption doesn't hold.