We demonstrate this across frontier models from OpenAI, Anthropic, and Google. The decoded reasoning closely tracks the number of hidden thinking tokens reported by the API. Each point below corresponds to one of 120 Codeforces problems: the horizontal axis shows the hidden thinking-token count reported by the API, while the vertical axis shows the token count of the decoded reasoning when passed back to the model as input.

We collected 6,708 publicly available agent trajectories from GitHub and Hugging Face, produced by Claude, GPT, and Gemini models and still containing encrypted reasoning blocks. Applying our decoding pipeline to every signed block yielded 315,320 reconstructed reasoning blocks.

These hidden traces contain real secrets and sensitive information. Restricting to genuine, non-benchmark user sessions, we recovered 704 distinct privacy artifacts, including 62 API keys, 33 passwords, 24 access tokens, and 30 personal email addresses, alongside names, postal addresses, internal URLs, and other technical identifiers.

Of those 704 artifacts, 64 appeared exclusively inside the reasoning blocks and nowhere in the visible session.

Decoded reasoning traces from benchmark runs and public sessions in the wild. Each example shows a selected passage from the recovered reasoning, with a short headline and highlights generated by Claude Opus 5 to make the traces easier to browse.

The case of Kimi-K3

Prefilling Kimi-K3's reasoning with the first 1% of tokens of Opus 4.8's reasoning moves its visible answer toward Opus's wording, even though the answer itself is never prefilled. Each card is one HLE problem: the seed Kimi-K3 was given, its answer with and without that seed, and the Opus answer they are compared against.

Jailbreaking for misuse uplift

Prompting a model to reason through harmful content while keeping its visible answer benign leaves hazardous knowledge inside the hidden trace. Our attack recovers that reasoning in plaintext. Captured from Opus 4.8, decoded with Haiku 4.5.

Summary unfaithfulness

For some AIME problems Opus 4.8 sometimes states the answer before deriving it. We find that the API summary does not always preserve this distinction, and can instead make the reasoning appear like a clean derivation.

BibTeX

@misc{panfilov2026stealing,
  title         = {Stealing Reasoning Traces from Proprietary LLM APIs},
  author        = {Alexander Panfilov and David Schmotz and Ilia Shumailov and
                   Luca Beurer-Kellner and Joachim Schaeffer and Ameya Prabhu and
                   Jonas Geiping and Maksym Andriushchenko},
  year          = {2026},
  eprint        = {2608.09867},
  archivePrefix = {arXiv},
  url           = {https://arxiv.org/abs/2608.09867}
}