AINEWS
OpenAI, Anthropic, and Google all share a flaw that lets outsiders read a model's hidden reasoning, and one Chinese model's traces look like those of US frontier models, raising a question about which model trained on which.
A research team has shown that the hidden reasoning that frontier AI models perform while solving a problem can be extracted by replaying encrypted reasoning traces into a weaker sibling model, and that the extracted reasoning can include passwords and API keys a user typed into the conversation. The same method, applied to publicly available models, gives the strongest independent forensic evidence to date of where those models were trained. The findings were first reported by Wired and are detailed in the researchers' paper.
Frontier models run chain-of-thought reasoning in a hidden block before they answer. That hidden block is the step-by-step planning the model does on its own, separate from the response the user actually sees. To keep that internal monologue private, the providers encrypt it before sending it over the API. The attack, built by researchers at the University of Tübingen, the Max Planck Institute, MATS Research, and the security firm Snyk, does not break that encryption directly. It takes the encrypted reasoning trace from a strong frontier model and replays it as input to a weaker sibling model from the same provider, a smaller, cheaper model that has received less of the safety tuning its larger sibling got. The sibling model, asked to continue the trace, often reproduces the hidden reasoning in readable plaintext.
"All major frontier model providers we tested share this vulnerability," lead researcher Alexander Panfilov told Wired. "It can lead to personal information leakage, and it enables large-scale reasoning distillation attacks." The team's paper names the personal data risk first: a model asked to help a developer debug a script may, in its hidden reasoning block, retain the database password or API key that appeared earlier in the conversation. The encrypted trace carries that information out of the session. Anthropic, OpenAI, and Google have partially fixed the leak, the researchers say, but a full fix would require redesigning how the encrypted reasoning block is sent to the client, a fundamental API overhaul rather than a patch.
When the researchers fed the encrypted reasoning traces from a known frontier model into publicly available open-weight models, the kind that publish their full neural-network parameters for anyone to download, one model stood out. Kimi K3, built by the Chinese lab Moonshot AI, produced hidden reasoning strikingly similar to the traces returned by Anthropic's Claude Opus 4.8 and OpenAI's GPT 5.6 Sol. The paper flags the finding carefully: the work "cannot causally establish distillation." Similar traces are evidence consistent with distillation, not proof of it. Two other open-weight models, DeepSeek's reasoning model and Inkling from the US lab Thinking Machines, did not show the same match with Claude Opus, which is why researchers read the Kimi K3 result as a signal worth asking about rather than a verdict.
That signal lands in a dispute already running in Washington. In February 2026, OpenAI told US lawmakers that DeepSeek appeared to have distilled one of its models to build R1. In June 2026, Anthropic told lawmakers that Alibaba had run a "brazen" distillation campaign against its models. The new paper does not allege distillation. It supplies an independent instrument for the same question, a way to ask "was this model trained on that one?" that does not rely on the lab's own filings or the provider's testimony. The vulnerability is partially fixed. The category of risk it opened is not.