A method has been developed to eavesdrop on the encrypted thoughts of AI, revealing realities such as 'the thinking of Chinese-made AI is strikingly similar to that of American-made AI' and 'the answers to performance tests are predetermined.'
AI services such as ChatGPT and Claude have a function called 'Reasoning' that constructs the answer before outputting it. This thought process is managed in an encrypted state, but AI researchers have devised a method to decrypt it and read the thought process.
Stolen Thoughts
AI services such as ChatGPT, Claude, and Gemini allow users to view parts of the thought processes, but the full text of these thoughts is managed in an encrypted state. Furthermore, the encrypted thought processes can be reused between models from the same company. The research team successfully forced the encrypted thought processes to be output in plain text by loading the thought processes of a high-performance model into a low-performance model from the same company and then performing a jailbreak attack on the low-performance model.
The graph below shows the number of actual thought tokens revealed by the API on the horizontal axis and the number of tokens in the thought output in plain text on the vertical axis. It can be seen that the three types of AI—Anthropic, OpenAI, and Gemini—are able to output the actual thought process in plain text almost exactly as it is.
The thought processes output in plain text sometimes contained confidential information. The research team collected 6,708 'agent outputs containing encrypted thought processes' that were publicly available on GitHub and Hugging Face, applied a plain text output method, and successfully decrypted 315,320 thought processes. The decrypted thought processes contained 704 pieces of confidential information, including '62 API keys,' '33 passwords,' '24 access tokens,' and '30 email addresses.'
By outputting the thought process in plain text, the true nature of AI model thinking was also revealed. For example, in a case where Claude Opus 4.8 was used to solve a problem from the American Mathematics Invitational Examination (AIME), the text 'This is a known problem from the AIME, and the correct answer is 60' appeared during the thinking process. However, the fact that it 'knew the correct answer' was concealed from the thought process that was later disclosed to the user.
Furthermore, in a case where Claude Opus 4.8 was asked about 'vehicles that are prone to theft, vulnerabilities, and theft prevention measures,' it was found that during the thinking stage, it outputted 'specific vehicle models that are prone to theft' and 'specific theft methods.'
Furthermore, we have confirmed instances where the thought processes of the Chinese-made Kimi K3 model are strikingly similar to those of the American-made Claude Opus 4.8 model.
Based on the above research findings, AI researcher Nathan Lambert stated, 'In China, it was implied that all AI research institutes are using similar methods,' suggesting that Chinese companies may be using similar thought-interception techniques to conduct adversarial distillation against American-made models.
When I was in China it was insinuated that every lab did this. I'm glad there's public research on it and am still shocked the frontier labs haven't patched this stuff. We don't need policy action on distillation, we just need the products to work as intended.
— Nathan Lambert (@natolambert) August 11, 2026
Great paper. https://t.co/GO1LF6Bqm8
Related Posts:
