Stealing Reasoning Traces from Proprietary LLM APIs Alexander Panfilov 1 2 3 4 * David Schmotz 2 3 4 * Ilia Shumailov 5 * Luca Beurer-Kellner 6 Joachim Schaeffer 1 Ameya Prabhu 2 4 7 ‡ Jonas Geiping 2 3 4 ‡ Maksym Andriushchenko 2 3 4 ‡ 1 MATS Research 2 ELLIS Institute Tübingen 3 Max Planck Institute for Intelligent Systems 4 Tübingen AI Center 5 AI Sequrity Company 6 Snyk 7 University of Tübingen *Equal contribution, order decided by dice roll · ‡Equal supervision TL;DR Proprietary reasoning can be recovered from its encrypted traces. Anthropic, OpenAI, and Google return encrypted chain-of-thought blocks to clients that can be replayed across sessions, users, and models. We take a trace produced by a frontier model, replay it into a weaker sibling, jailbreak the weaker model, and recover the stronger model’s hidden reasoning in plaintext, without ever attacking the stronger model directly or triggering its anti-distillation safeguards.…