Researchers have identified a critical architectural vulnerability in the proprietary APIs of OpenAI, Anthropic, and Google stemming from a "security-by-design" failure in Chain-of-Thought (CoT) handling. The vulnerability involves the client-side offloading of encrypted reasoning traces that use symmetric encryption keys shared across entire model families. By capturing traces from flagship models (e.g., GPT-5.6, Claude Opus 4.8) and replaying them via API calls to smaller, less-aligned sibling models (e.g., Claude Haiku 4.5), attackers can bypass refusal mechanisms to transcribe reasoning in plaintext. This enables large-scale model distillation, exfiltration of PII and credentials, and the execution of "invisible" prompt injections within the model's internal reasoning logic.

• Threat Model & Vulnerability Overview

  • Mechanism: Client-side offloading of reasoning.encrypted_content to manage state and optimize API performance.
  • Critical Flaw: The use of shared symmetric encryption keys across disparate model sizes and versions within a single family.
  • Core Risk: A side-channel that allows for the extraction of proprietary Chain-of-Thought (CoT) reasoning logic.

• Attack Mechanics & Exploitation Vector

  • Attack Vector: Cross-model replay attacks leveraging captured reasoning blocks.
  • Exploitation Method: Replaying flagship-generated traces into smaller, less-aligned sibling models that lack robust refusal mechanisms.
  • Payload: Deployment of specialized jailbreak prompts (e.g., <thinking-copy> transcription directives) to force the model to output decrypted reasoning verbatim.

• Systemic & Security Impact

  • Model Distillation: Successful distillation of closed-source logic into models like KimiK3, achieving >85% semantic overlap.
  • Data Leakage: Empirical recovery of 367 PII artifacts and 182 sets of credentials from intercepted reasoning traces.
  • Integrity Compromise: Capability for "invisible" prompt injections that are treated as sacrosanct by the model's internal reasoning process.

• Countermeasures & AI Alignment

  • Key Isolation: Mandatory implementation of unique, non-shared encryption keys for every model tier and instance.
  • Alignment Parity: Extending flagship-level safety and refusal capabilities to smaller, high-throughput models.
  • Architectural Hardening: Re-evaluating the security implications of client-side offloading for sensitive reasoning state.

• Conclusion

  • Summary: A systemic failure in the security boundaries between high-intelligence flagship models and their smaller counterparts.
  • Risk Profile: Critical threat to intellectual property protection and user data privacy for enterprises utilizing third-party LLM APIs.