Tim Scarfe interviews Ilia Shumailov and Alexander Panfilov about a weakness in the encrypted reasoning state returned by several frontier-model APIs. The state is meant to let a conversation resume or fork without revealing the hidden chain of thought, but the researchers found that it can be replayed outside its original context.
A smaller related model can process a captured reasoning blob and repeat the hidden content in plain text. That can expose sensitive details preserved in a shared conversation even when the visible prompt and answer have been sanitized, and it complicates chain-of-thought monitoring because some traces use terse or unusual internal language.
The same portability can place fabricated reasoning into another conversation or a downloaded agent trace. A resumed model may then treat the injected state as its own prior thought, creating a path for jailbreaks, prompt injection and poisoned long-running agent workflows.
The discussion separates the demonstrated replay and jailbreaking risk from broader claims about model distillation, which the evidence does not prove. Proposed defenses include keeping reasoning state server-side, binding it to a user, model and conversation, blocking repeated state, detecting leaked reasoning patterns and testing mitigations in controlled experiments.
Watch on YouTube
