The CoT Leak: Stealing Hidden Reasoning Traces via Cross-Model Replay Attacks

New research reveals a critical vulnerability in how top-tier AI providers like OpenAI and Anthropic handle encrypted Chain-of-Thought (CoT) data, allowing attackers to extract hidden reasoning by replaying encrypted tokens to weaker, jailbroken models.

• ▶ The Replay Flaw: Encrypted reasoning chunks returned via APIs are not cryptographically bound to a specific session, enabling cross-session and cross-model replay attacks.
• ▶ Exploiting Model Lineage: By feeding a high-end model’s reasoning trace into a smaller, more vulnerable model within the same family, attackers can bypass visibility constraints to reveal proprietary logic.

Bagua Insight

This discovery shatters the illusion of “security through obscurity” that many LLM providers have relied on for their reasoning models. The vulnerability stems from the architectural consistency within model families; because models like Claude 3.5 Sonnet and Haiku share similar latent representations, an encrypted trace meant for one is often intelligible to the other. This isn’t just a minor bug—it’s a fundamental failure in the isolation of the reasoning process. As labs push for more complex multi-step reasoning, the inability to secure these “internal monologues” means that the very IP that differentiates a model—its logic and strategy—is now up for grabs by sophisticated actors.

Actionable Advice

API providers must transition from simple encryption to session-specific, non-replayable tokens that are hardware-bound or tied to a unique request context. For AI architects, the takeaway is clear: do not treat “hidden” reasoning as a secure vault for sensitive data or proprietary algorithms. Until cryptographic isolation is standardized, assume that any data sent to a client—even if encrypted—is potentially discoverable. Security audits should now specifically target the boundary between different model tiers within the same provider ecosystem.