Computer scientists have found a way to extract the private step-by-step thinking that advanced AI models use when solving hard problems, Wired reports (open copy). These internal notes, often called reasoning traces or chain of thought, are normally kept hidden by the companies that build the models. The discovery shows that the hidden notes can be recovered and, in some cases, match the output of certain downloadable Chinese models closely enough to suggest possible copying, although the researchers stress this is not conclusive proof.
The same approach also recovered sensitive details such as passwords and API keys that had been embedded in a model’s private reasoning. All major frontier models tested, including those from OpenAI, Anthropic and Google, shared the vulnerability when accessed through their APIs. The companies have since adjusted their systems so personal data can no longer be recovered this way, yet some reasoning information can still be extracted.
How the hidden steps become visible
Most providers offer both large and smaller versions of the same model family. The larger versions receive stronger safety training that teaches them to refuse requests that would reveal secrets. The smaller versions receive less of this training. Companies often send an encrypted copy of the large model’s reasoning steps to the user’s computer to help with computation. When those encrypted steps are instead given to the smaller sibling model, the weaker safety training allows the hidden reasoning to be revealed in plain text.
Distillation is a standard technique in which a new model is trained to copy the abilities of an existing stronger model by learning from its outputs or internal steps. It is widely used, especially for creating open-weight models whose internal numbers can be freely downloaded. Recent claims have suggested that some Chinese companies used distillation to copy leading US models, but the researchers note there is no evidence that the specific method they discovered was employed. Still, the technique could allow more detailed information to be copied than was previously thought possible.
The findings highlight both a security risk that has been partly fixed and an ongoing debate about how openly knowledge should flow between AI systems.