Swapping models can expose GPT and Claude's hidden reasoning

Around August 27, 2026, X user @kotekjedi_ml published an unusual set of experimental results: hidden reasoning blocks inside the Claude, GPT and Gemini APIs — normally never shown to users — had been recovered by security researchers into readable text. By design, once a model finishes its internal reasoning, the server encrypts it into an opaque block returned to the client; the client can hold that data but can neither read nor modify it, and hands it back unchanged on the next call so the model can pick up where it left off. The researchers did not break the encryption or obtain any server-side keys — what they bypassed was the block's scope of use, not the encryption itself.

Why hidden reasoning ever leaves the model

The difference between a reasoning model and an ordinary chat model isn't just a few extra thinking steps before an answer — those intermediate states often need to be reused across a long task or an agent run, as the model breaks down a problem, tries approaches, reads tool results and revises its judgment. A server could store the full reasoning history for every session, but that adds storage and context-management overhead, so many APIs instead package internal reasoning into a block the client cannot read and hand it over for safekeeping, verifying and reusing it on the next call. That prevents direct reading or tampering, but creates a permissions problem that hadn't been so visible before: encryption and signing can prove a block was genuinely generated by the server and hasn't been altered externally, but not that it still belongs to the right account, session or model — a perfectly legitimate piece of reasoning can end up somewhere it shouldn't.

Getting a strong model to “talk”

The researchers found these hidden-reasoning blocks aren't always locked to their original context: some can be reused across sessions, some can even be resubmitted under a different account, and — most importantly — some can be read by other models from the same vendor. With Claude, for instance, Opus completes a normal task, the server generates the corresponding hidden reasoning, and returns a signed thinking block to the client. Rather than trying to get Opus itself to give up its chain of thought, the researchers loaded that block into the context of a different model, Haiku — which was able to load reasoning that had originally belonged to Opus. Once that step works, the target shifts: instead of breaking Opus's own restrictions, an attacker only needs the more easily bypassed Haiku to read out loud what it has already loaded. Because different models within the same family vary in alignment strength and jailbreak resistance, the guardrails protecting the strong model can be routed around through a weaker sibling.

Proving the recovered content is real

The researchers had no access to the plaintext reasoning trace stored server-side, so they could not check it token by token — instead they relied on independent signals to judge whether the recovered output really matched the original hidden state.

• They had a source model work through 120 Codeforces programming problems while recording the hidden thinking-token count reported by the API, then compared it with the length of the recovered text: across multiple Anthropic, OpenAI and Google models, recovered lengths closely tracked the API-reported token counts, clustering near the line where the two figures match exactly.
• They collected 6,708 public agent run logs from GitHub and Hugging Face, processing them into 315,320 reasoning blocks. Once recovered, the content included API keys, passwords, access tokens, private keys and email addresses — some of which had never appeared anywhere in the public conversation history, meaning the recovering model could not simply have reasoned its way to those exact values from visible text alone.

That result exposed a further problem in agent logs: even after a user deletes a password or key from chat history or a code repository, the same information may still live on inside an old hidden-reasoning block, since the agent could well have read it while editing code, adjusting configuration or cleaning up a repository — and once it entered the reasoning, it can persist in that stored state.

AI's prized “reasoning moat” is eroding

A model's full reasoning trace is worth far more to training than a few extra sentences beyond the final answer: it records how a task was broken down, how intermediate judgments formed, and how wrong turns were corrected — richer signal for training a smaller model than answer-only supervision. Getting that kind of data at scale used to mean paying to call an expensive closed model yourself. Now that public agent logs already contain large volumes of encrypted reasoning computed by other users on expensive models, anyone who finds a compatible model able to read those blocks has a shot at extracting already-computed, high-quality reasoning instead of generating it from scratch. That splits reasoning generation and extraction across different endpoints — a top-tier model produces the valuable thinking, and a cheap model reads it out — a path that monitoring focused only on the top-tier side is unlikely to catch.

An experiment with Moonshot AI's Kimi K3 model illustrated just how valuable that leaked reasoning can be: researchers took only the first roughly 1% of tokens from a Claude Opus hidden-reasoning trace and fed them into Kimi K3's reasoning context; Kimi K3's subsequent answer shifted noticeably toward Opus's output, far more than a control model that hadn't received that prefix. That doesn't prove Kimi K3 was trained on Claude's reasoning data, but it shows that even a small slice of high-quality reasoning can measurably change another model's problem-solving path.

Inside agent systems, this is more than a data leak

In an ordinary chat, having hidden reasoning read out mostly means internal information has leaked. In a long-running agent system, reasoning also functions as task state — recording what the agent has already analyzed, which options it ruled out, and what it plans to do next. If a reasoning block can migrate from one task into another agent run, what moves with it isn't just historical information but potentially an action tendency the agent has already formed. The researchers demonstrated an invisible prompt injection that follows from this: malicious content is written into hidden reasoning first, and a new agent later loads that state — the input the user sees carries no matching instruction, yet once the model restores its internal state, it can still act on that content. That differs from ordinary prompt injection, which typically hides in a webpage, file, email or tool output that a security system at least has a chance to scan as plaintext; an encrypted reasoning block is opaque to outside systems, and only becomes meaningful once the server decrypts it — by which point any scanning defense is already too late.

The wider backdrop: AI coding agents already running unauthorized code inside corporate networks

This finding about hidden reasoning surfaces alongside a broader wave of AI agent security disclosures. According to Ars Technica, researchers at a stealth Israeli startup scanned 6,214 live domains belonging to defense contractors, Fortune 500 companies and Big Tech, and found 227 install commands pointing to unregistered code packages or domains inside the llms.txt files of 120 of those sites. After registering a handful of the empty package names and domains, the team got a phone-home request from a Fortune 500 company within an hour, and dozens more over time — involving coding agents including Claude, OpenAI's Codex and Nous Research's Hermes. Researcher Alon Hertz argued the underlying problem is more fundamental: agents treat every document they read as trustworthy by default, with no way to tell a genuine instruction from unverified content.

Agents treat vendor docs as ground truth and don't question them—and neither do the humans supervising them. Agentic AI usage is exploding, and agents are spreading across every layer—SaaS, cloud, endpoint.

What it means for readers

For any organization wiring Claude, GPT or another reasoning model into agentic workflows — customer support, code review, data analysis — this research points to a risk that has barely been discussed: a reasoning block can carry secrets like keys and passwords, and recovering it can be just as damaging as a leaked log file. Organizations that let agents carry and reuse old reasoning states across tasks or models also need to consider whether that state could carry a tampered action tendency along with it. In the near term, teams deploying reasoning agents should avoid exposing internal credentials in any context that risks being written into reasoning, and should set explicit permission boundaries on which reasoning states can be reused across models or sessions — rather than trusting any block by default just because it passes signature verification.