Security researchers have uncovered a structural vulnerability across Anthropic, OpenAI, and Google APIs, revealing that opaque, encrypted chain-of-thought (CoT) tokens could be replayed across distinct sessions, user accounts, and model tiers. As detailed in findings hosted at stolen-thoughts.com, major providers shared cryptographic keys across entire model families instead of binding them to specific model instances. This architectural oversight allowed attackers to capture encrypted reasoning traces generated by flagship models and replay them directly into weaker, cheaper siblings within the same ecosystem.
Once the reasoning payload was injected into a less heavily safeguarded model, extracting the hidden logic became straightforward. By executing standard jailbreaks—such as setting an assistant turn prefix and instructing the recipient model to transcribe its internal reasoning verbatim within output tags—researchers retrieved the unencrypted, proprietary reasoning traces in clear plaintext. Beyond exposing proprietary distillation material, the exploit opened doors to cross-session prompt injection, where malicious instructions embedded in the reasoning blocks bypassed standard input filters and executed with elevated trust.
While all affected vendors acknowledged the vulnerability disclosures and patched their API key-binding mechanisms, the incident exposes a recurring blind spot in AI infrastructure engineering. Treating encrypted context objects as generic bearer tokens without strict, model-level cryptographic binding effectively undermined the intellectual property defenses surrounding flagship reasoning architectures, demonstrating how easily auxiliary API abstractions can compromise core model security.