@MaxForAI: Just now, a paper that could shake the large model community was published! For the first time, researchers systematically “stole” the real hidden chain-of-thought on a large scale from OpenAI, Anthropic, and Google's closed-source models. Then, they went ahead and used these chains to study Kimi K3, GLM-5.2…

Just now, a paper that might cause an earthquake in the LLM community was published!

For the first time, researchers systematically “stole” the hidden chain-of-thought from closed-source models at OpenAI, Anthropic, and Google on a large scale.

Then they went ahead and used those chains of thought to study a number of open-source models including Kimi K3, GLM-5.2, DeepSeek, and others.

The results are very interesting.

01 | It turns out closed-source models’ CoT can really be “stolen”

OpenAI, Anthropic, and Google are all increasingly unwilling to hand over full chains of thought to users.

The reason is easy to understand: the final answer can be copied, but what’s truly valuable is how the model “thinks.”

Once a complete CoT is extracted in bulk, it can be directly used for distillation to train your own models.

That’s why many APIs now encrypt the model’s reasoning and return it to the client. You can’t see the content, but on the next request, you can send that encrypted blob back to the model so it can continue thinking.

Then the researchers found an absurd vulnerability:

These encrypted chains of thought are actually compatible across different users, sessions, and even different models from the same vendor.

So the attack method is almost ridiculously simple:

Let the strongest model think → get the encrypted CoT → throw it at a weaker, easier-to-jailbreak model from the same vendor → have the small model “read” it out.

For example, Claude Opus 4.8’s hidden chain of thought can be given to Haiku to “recite.”

You don’t even need to break Opus—just find its little brother Haiku.

In the end, the paper successfully extracted hidden reasoning from all three API families—Claude, GPT, and Gemini—effectively bypassing the protection that vendors originally put in place to prevent CoT distillation.

Alexander Panfilov (@kotekjedi_ml): We can finally talk about it:

We found a way to extract hidden reasoning of frontier models using a vulnerability in the APIs of every frontier AI company.

We verified that our reasoning token count matches billed API thinking tokens 1:1 for most of the prompts we queried.