We demonstrate this across frontier models from OpenAI, Anthropic, and Google. The decoded
reasoning closely tracks the number of hidden thinking tokens reported by the API. Each point below
corresponds to one of 120 Codeforces problems: the horizontal axis shows the hidden thinking-token count
reported by the API, while the vertical axis shows the token count of the decoded reasoning when passed
back to the model as input.
We collected 6,708 publicly available agent trajectories from GitHub and Hugging Face,
produced by Claude, GPT, and Gemini models and still containing encrypted reasoning blocks. Applying our
decoding pipeline to every signed block yielded315,320 reconstructed reasoning blocks.
These hidden traces contain real secrets and sensitive information. Restricting to genuine,
non-benchmark user sessions, we recovered704 distinct privacy artifacts, including 62 API keys, 33
passwords, 24 access tokens, and 30 personal email addresses, alongside names, postal addresses, internal
URLs, and other technical identifiers.
Of those 704 artifacts,64 appeared exclusively inside the reasoning blocksand nowhere in the visible
session.
Decoded reasoning traces from benchmark runs and public sessions in the wild. Each example
shows a selected passage from the recovered reasoning, with a short headline and highlights generated by
Claude Opus 5 to make the traces easier to browse.
Prefilling Kimi-K3’s reasoning with the first1%of tokens of Opus 4.8’s reasoning moves itsvisible answertoward Opus’s wording, even though the answer itself is never prefilled.
Each card is one HLE problem: the seed Kimi-K3 was given, its answer with and without that seed, and the
Opus answer they are compared against.
Prompting a model to reason through harmful content while keeping its visible answer benign leaves
hazardous knowledge inside the hidden trace. Our attack recovers that reasoning in plaintext. Captured
from Opus 4.8, decoded with Haiku 4.5.
For some AIME problems Opus 4.8 sometimes states the answerbeforederiving it. We find that
the API summary does not always preserve this distinction, and can instead make the reasoning appear like a
clean derivation.