AI hidden reasoning traces from some frontier models could be recovered through a weakness in how their APIs handled encrypted data, according to research reported by Wired. The finding matters less as a peek into a machine “mind” than as a security and competition problem: the demonstrations exposed credentials embedded in those traces and could make it easier to copy useful reasoning patterns from closed models.
The work came from researchers at the University of Tübingen, the Max Planck Institute, MATS Research and Snyk. They reported the issue in models from OpenAI, Anthropic and Google that they tested through application programming interfaces. That is a defined test set, not evidence that every AI system has the flaw.
How did the replay attack expose hidden reasoning traces?
Some advanced models generate written intermediate steps while handling difficult tasks. Providers generally keep that text from users, in part because it can be useful training material for a competing model. Wired reported that encrypted versions of the reasoning were nevertheless sent to a user’s computer to shift some computation off the provider’s systems.
The researchers’ method captured those encrypted traces and submitted them to a smaller variant of the same model. According to Wired, the smaller version shared the relevant decryption setup but had less alignment training, making it more likely to disclose text that its larger counterpart would withhold. This recovered portions of the written reasoning, not the full set of numerical operations inside the neural network, and certainly not proof of consciousness. Computers remain stubbornly unromantic about this stuff.
In demonstrations, the traces included API keys and passwords, Wired reported. The researchers alerted OpenAI, Anthropic and Google before publication. Each changed its API, and Wired reported that the route could no longer extract private information, although researcher Alexander Panfilov said some reasoning text could still be recovered.
Anthropic spokesperson Michael Aciman said the company had begun short-term mitigations for the replay behavior. He said the research did not obtain encryption keys, enter Anthropic infrastructure, or recover personal data from its systems. Google and OpenAI declined comment, according to Wired.
Does this prove Chinese models were distilled from US models?
No. The same research tested 90 questions for possible overlap between open-weight models and proprietary models. Wired reported that when researchers provided the opening words of captured proprietary traces, Moonshot AI’s Kimi K3 sometimes produced notably similar continuations to traces associated with Claude Opus 4.8 and GPT-5.6 Sol.
The researchers explicitly said their results could not establish that distillation caused that similarity. They also reported no comparable reasoning similarity between Claude Opus and DeepSeek or Thinking Machines’ Inkling. Wired said there is no indication Chinese companies used this particular replay technique.
What is different about AI interpretability research?
Recovering encrypted text is separate from mechanistic interpretability, which tries to trace internal computational pathways. Anthropic’s own research on Claude 3.5 Haiku says its circuit-tracing tools capture only a fraction of a model’s computation, may introduce artifacts, and take hours of human analysis even for short prompts. That is a useful warning against treating either technique as a complete audit of what a model is doing.
The immediate credential leak has reportedly been addressed. The harder engineering problem remains: providers want to use hidden reasoning in their services without making that material available for extraction, replay, or model-training shortcuts.
This story draws on original reporting from WIRED.
