Stealing Reasoning Traces from Proprietary LLM APIs

<p><strong><a href="https://stolen-thoughts.com/">Stealing Reasoning Traces from Proprietary LLM APIs</a></strong></p> A vanity domain name (<code>stolen-thoughts.com</code>) for <a href="https://www.alphaxiv.org/abs/2608.09867">a neat paper</a>:</p> <blockquote> <p>Anthropic, OpenAI, and Google return encrypted chain-of-thought blocks to clients that can be replayed across sessions, users, and models. We take a trace produced by a frontier model, replay it into a weaker sibling, jailbreak the weaker model, and recover the stronger model’s hidden reasoning in plaintext</p> </blockquote> <p>You can see an example of these encrypted blocks by running:</p> <div class="highlight highlight-source-shell"><pre>curl https://api.openai.com/v1/responses \ -H <span class="pl-s"><span class="pl-pds">"</span>Content-Type: application/json<span class="pl-pds">"</span></span> \ -H <span class="pl-s"><span class="pl-pds">"</span>Authorization: Bearer <span class="pl-s"><span class="pl-pds">$(</span>llm keys get openai<span class="pl-pds">)</span></span><span class="pl-pds">"</span></span> \ -d <span class="pl-s"><span class="pl-pds">'</span>{</span> <span class="pl-s"> "model": "gpt-5.6-luna",</span> <span class="pl-s"> "input": "Solve step by step: What is the smallest positive integer divisible by every integer from 1 through 20?",</span> <span class="pl-s"> "reasoning": {</span> <span class="pl-s"> "effort": "medium"</span> <span class="pl-s"> },</span> <span class="pl-s"> "include": ["reasoning.encrypted_content"],</span> <span class="pl-s"> "store": false,</span> <span class="pl-s"> "stream": false</span> <span class="pl-s"> }<span class="pl-pds">'</span></span></pre></div> <p>Here's the <a href="https://simonwillison.net/atom/everything/">full output</a>, which includes chunks that look like this:</p> <pre><code> "output": [ { "id": "rs_0a7479de7ebae170016a7ba1a0334c8198a95590217efe343c", "type": "reaso