Vendors Locked the Front Door, but Forgot the Window

Major model vendors have reached an unspoken consensus: you don’t get to see the raw reasoning process. OpenAI, Anthropic, and Google only return either a “summarized thought process” or a chunk of encrypted data through their APIs, which you can pass back unchanged so the model can continue the context, but you cannot read its contents.

The rationale is perfectly legitimate: raw reasoning may contain API keys, email addresses, access tokens, or even login private keys. By packaging reasoning into opaque data blobs, vendors have blocked the “read it directly” path.

But that wall only seals one exit. The model’s reasoning ability itself has not been shut off; it has merely been pushed into a hidden channel. As long as the model can still think, it will find somewhere to write down its thoughts—even if all you do is hand it a fresh piece of scratch paper.

The Naive Bypass: Give It a Tool

The method is so simple it barely looks like an attack: turn off the vendor’s hidden reasoning feature, then attach an external tool called deep_think to the model. The tool has only one parameter, used to fill in text. Before answering, the model voluntarily writes its analysis into the tool parameter, and that parameter is returned to the developer in plaintext through the API.

No breaking encryption, no attacking the model, no exploiting vulnerable code. You close the front door, I pass in a sheet of paper through the window, and the model starts writing on its own.

This path works because the model cannot distinguish, semantically, between an “internal reasoning channel” and an “external tool call”—to it, both are places where thinking can be expressed. Once the vendor shuts down the former, the latter becomes a natural leakage outlet.

Two Paths: Extraction vs. Reconstruction

There is already academic groundwork for this direction. In the paper Stealing Reasoning Traces from Proprietary LLM APIs, Alexander Panfilov and others showed that encrypted reasoning data returned by vendors can be “decoded” and reconstructed by another model: hand the encrypted data to a less-protected model from the same vendor, and it can re-output the reasoning process hidden by the stronger model inside the encrypted blob as plain text. The paper also found that extracting certain Claude and GPT reasoning fragments from Kimi-K3 was nearly one million times easier than extracting them from other models.

Even more dangerous is the “injection attack”: first have a weaker model write malicious instructions into encrypted reasoning data, then hand it to a stronger model for processing. The stronger model treats it as its own prior line of thought and executes it while the user never sees the malicious instruction at all—an implicit form of prompt injection.

But that path has one prerequisite: encrypted reasoning data must be transferable across multiple requests. The tool-parameter method skips that prerequisite entirely—what it obtains is not the original reasoning record, but an analysis draft that the model rewrites on the spot, which may be closer to the model’s real internal reasoning.

Three Experiments

Tested on GPT-5.6 Luna: given a number theory problem requiring substantial derivation (Vieta jumping and proposition checking on the Markov triple graph), the model, with native reasoning turned off, still proactively called deep_think and wrote a dense analysis process into the parameter.

This content was not a polished explanation organized for the user. It was “caveman language” made up of short phrases, abbreviations, and jumpy expressions—a shorthand draft written only for itself. After switching reasoning levels (off/low), the method still worked. The reasoning level is essentially just a number in the system prompt; changing that number can affect how much reasoning the model invests, without needing to re-enable the vendor’s hidden channel.

The same worked on Claude Fable 5—even with the reasoning level set to off, the model still used the external tool to check propositions step by step, calculate examples, and organize a proof. Anthropic is usually good at intercepting this type of content with regex rules, but this time the reasoning process flowed out through another exit.

The Security Paradox: The More Complex the Lock, the More It Fears the Simplest Key

The most noteworthy part of this is not the method itself, but the security paradox it reveals.

Vendors have invested heavily in engineering encrypted reasoning data: opaque data blobs, user isolation, session binding, model binding. But all of these protections rest on the assumption that “reasoning can only flow out through the vendor-designated channel.” Once the model gains the ability to call external tools—which is standard in the Agent era—there is now an extra exit outside the vendor’s control.

The more complex the security mechanism, the easier it is to bypass with the most naive approach. No matter how strong the encryption is, the model itself can write its thoughts somewhere else. This is not something vendors can fix unilaterally—unless they forbid models from calling external tools, which would amount to cutting off the core capability of Agents.

A Double-Edged Sword: Visible = Controllable, but Also = Leaky

For developers, being able to see the reasoning process is a good thing: it helps diagnose errors, optimize prompts, and understand model decisions. Oh My Pi has already turned this method into an official feature called externalThinking; when users enable it, Pi automatically prepares “external scratch paper” for the model.

But the risks grow with it. In its scratchpad, the model may write source code, personal information, or even account credentials. Once this content enters tool parameters and runtime logs, it can be saved, copied, and forwarded—information that was originally hidden inside the model begins to be exposed to more people and systems.

From this point on, AI security should not focus only on the model itself, but also on the entire tool system around it. Vendors may be able to seal off one hidden reasoning channel, but they may not be able to seal every path from the model to the outside world.

Direct Implications for Developers

If you are building applications with the OpenAI/Anthropic/Google APIs, these three things are worth doing right now:

• Audit tool-parameter logs: your Agent tool-call logs may already contain the model’s reasoning drafts; check who has permission to read those logs
• Don’t pass reasoning data across sessions: even if vendors allow it, the path of passing encrypted reasoning data across users or models is an attack surface already proven by research
• Add one assumption to your threat model: assume an attacker can read the model’s reasoning process—could API keys, connection strings, or internal logic appear in the draft?

LynxHot · Tracking AI tools, models, and industry shifts