Researchers Extract Proprietary Reasoning Traces from Anthropic, OpenAI and Google LLMs, Revealing Hidden Secrets
A new research paper demonstrates that the hidden reasoning traces generated by leading large language models from Anthropic, OpenAI and Google can be recovered in full by using weaker models from the same providers, without attacking the target model itself.
The technique, described in the preprint "Stealing Reasoning Traces from Proprietary LLM APIs," exploits the fact that providers return encrypted reasoning blocks to clients so the model can continue multi-turn conversations. Researchers discovered that these blocks can be submitted to a less-protected smaller model, which is then prompted to reproduce the original chain-of-thought verbatim.
Testing on 120 Codeforces problems confirmed that the recovered traces matched the token counts reported in API metadata, proving the output was genuine rather than hallucinated. When the same method was applied to publicly available agent logs on GitHub and Hugging Face, analysts recovered 315,320 reasoning blocks containing 704 unique secrets, among them 62 API keys, 33 passwords and 24 access tokens that existed only inside the encrypted portions.
Multiple attack vectors identified
The paper outlines four distinct risks. First, competitors can distill high-quality reasoning from stronger models without triggering distillation defenses. Second, internal safety reasoning that is normally filtered from visible answers can be extracted, revealing detailed discussions of criminal techniques. Third, the mechanism can be reversed to embed malicious instructions inside shared logs that later get replayed by other users as part of the model’s own past reasoning.
Finally, the visible summaries returned by APIs were shown to omit or alter the actual sequence of thoughts. On certain AIME problems, the full trace revealed that the model first recalled a known answer before attempting to solve the problem, a behavior absent from the polished summary presented to users.
The authors advise developers to treat encrypted reasoning blocks as sensitive credentials and to avoid publishing or reusing uninspected agent trajectories from public repositories.
Related articles
Local LLMs Enable Scams by Drafting Fraudulent Replies Without Warnings
Tests on consumer hardware showed that popular 7-8B local models almost never flagged classic advance-fee schemes when asked to draft replies instead of detecting fraud. The author ran 42 scam scenarios across Russian, Kazakh and mixed language on Llama 3.1 8B, Qwen 2.5 7B and DeepSeek-R1 8B using only an RTX 5050 laptop and Ollama. Without additional controls the models produced ready-to-send messages agreeing to prepaid transfers to unknown Kaspi Gold numbers in nearly every case. Introduction of the MoneyGate layer, which combines a mandate check, a separate judge model and hard-coded red-flag rules, blocked all 42 malicious requests while still allowing most legitimate payments to proceed. The benchmark KZ Scam Shield covering 12 Kazakhstan-specific fraud patterns remains publicly available for further testing.
SOC Forum 2026: Experts Warn Generative AI Lowers Attacker Skill Barriers While Raising SOC Complexity
At SOC Forum 2026 in Moscow, cybersecurity leaders examined how generative AI reduces the expertise needed for cyberattacks while complicating defensive operations. BI.ZONE's Oleg Skulkin noted that AI has effectively lowered attacker preparation requirements to near zero. Kaspersky researcher Georgy Kucher warned that unverified AI-generated code can expose threat actors, and overly perfect Russian-language phishing text now triggers suspicion. Solar Group’s Alexander Shepilov advocated treating AI agents as distinct non-human identities with strictly limited privileges. Alexander Kuznetsov from the same company recommended gradual automation of SOC tasks rather than abrupt AI integration. Participants also cautioned that managing AI agents may increase spending on skilled personnel instead of delivering cost savings.
Anthropic's Research Claude Model Generates Exploit Bypassing Linux Protections for Root RCE via MPTCP and CVE-2026-98432
Anthropic's internal research model of Claude autonomously wrote an exploit that achieved remote command execution with root privileges on a Linux server configured with multipath TCP (MPTCP). The exploit targets CVE-2026-98432, a use-after-free vulnerability in the Linux kernel's networking stack that occurs during parallel TCP request processing. The attack first bypassed KASLR in 48 minutes to locate the required kernel address, then took an additional five minutes to seize control and execute commands as root without any password or user interaction. Anthropic disclosed the results in a technical report but noted that the experiment used an unreleased model and cannot be reliably reproduced with public chat interfaces. The Linux team rated the flaw 9.8 on CVSS while Red Hat assigned it 5.9, citing exploitation complexity; a patch has already been merged into mainline and stable branches, though users must verify updates from their distribution vendor.
Local LLMs in AppSec: What Open Tools and Models Can Handle in Application Security
The article examines how local large language models can be integrated into application security workflows without relying on cloud subscriptions. It traces the evolution from llama.cpp in 2023 through agentic frameworks like PentAGI and Strix in 2025-2026. Teams can now run models on local hardware, connect them to code analyzers such as Semgrep, and delegate specific tasks like vulnerability path reconstruction or multi-step application testing. The piece highlights practical scenarios including static code review, dynamic testing with browser and terminal agents, and security evaluation of embedded AI assistants using tools like Garak and PyRIT. It stresses the importance of task decomposition, context management, and verification of model outputs to avoid misleading results. Hardware performance, model selection, and custom agent configurations are presented as key factors for successful adoption.