A research team led by Alexander Panfilov has found a way to extract encrypted reasoning processes through a vulnerability in the APIs of all leading AI providers. For most queries, the number of extracted tokens matches the billed thinking tokens exactly, meaning the researchers are capturing full internal reasoning. The encrypted thought processes are "fully portable across sessions, users, and models within a single provider." Anthropic's smaller model, Haiku 4.5, can read the thoughts of the more capable Opus 4.8 through jailbreaking, and the same trick works with OpenAI and Gemini. The story dates to May, when cryptography expert Matthew Green discovered that encrypted reasoning blobs could be replayed outside their original context and reported it to providers, who responded that "they don't see any security implications in side channels or replays." The new research suggests that assessment was wrong. The vulnerability feeds into the "distillation" debate, where a less capable model is improved by training on a more powerful one's reasoning. The researchers say it may have been possible to extract reasoning processes for training proprietary models without breaking cryptography, supporting concerns that Chinese model makers use these traces. Kimi-K3 is one example; with a few tokens from Opus's thought processes, its output shifts toward Opus. A memorization analysis showed specific Claude and GPT reasoning segments are up to six orders of magnitude easier to extract from Kimi-K3 than from the next closest model. The authors estimate API costs for decoding 10