Researchers Found a Way to Read AI’s Hidden Thoughts — What It Means for the AI Models You’ll Use in 2026

Introduction: The Problem With AI’s Secret Thinking

For the last two years, the most powerful AI models have been doing something they don’t fully show you: thinking. When you ask a frontier model like Claude, GPT, or Gemini to solve a hard problem, it often runs through a long internal “chain of thought” — breaking the task into steps, second-guessing itself, trying and discarding approaches — before it prints a tidy final answer. The companies that build these models treat that hidden reasoning as a crown jewel, and for good reason: it’s exactly what a competitor would need to clone their best work.

On August 11, 2026, WIRED reporter Will Knight covered a new piece of research that pries that crown jewel open. A team of computer scientists found a way to extract the hidden “reasoning traces” that frontier models generate as they work — and what they found has real implications for anyone picking an AI model or tool in 2026, from how secure your data is to whether the model you’re paying for is really as original as it claims.

How Researchers Cracked Open the “Reasoning Traces”

The trick exploits a mundane detail of how AI companies deliver reasoning to your screen. When a model “thinks,” providers often send an encrypted version of that reasoning to your computer so some of the computation can happen on your device. The catch — according to the work led by Alexander Panfilov with colleagues at the University of Tübingen, the Max Planck Institute, the AI-safety institute MATS Research, and the security firm Snyk — is that the same companies also sell smaller, cheaper versions of their models.

Those smaller models share the decryption key with their bigger siblings, but they’ve received less alignment training, meaning they’re far less likely to refuse to spill what they know. Feed the encrypted reasoning trace to the smaller, less-guarded model and it happily decrypts and reveals the hidden thinking. “The idea of swapping out messages to a weaker model variant which has the same decryption key but weaker alignment is very cool,” Florian Tramèr, a computer scientist at ETH Zürich, told WIRED. “It’s definitely becoming an issue.”

The Distillation Fingerprint: Is One Model Copying Another?

The most attention-grabbing finding is what those extracted traces revealed about who’s been learning from whom. The team fed 90 questions to a set of models, then handed some open-weight models the first few words of reasoning traces captured from closed US models. The Chinese open-weight model Kimi K3, from Moonshot AI, produced answers “strikingly similar” to the hidden reasoning of Claude Opus 4.8 and GPT-5.6 Sol. That kind of resemblance is the tell-tale signature of distillation — training one model on the outputs of another.

The researchers are careful not to overclaim. In their paper they write that the work “cannot causally establish distillation,” and they note that two other open-weight models they tested — China’s DeepSeek and Inkling, from Mira Murati’s Thinking Machines — did not show the same reasoning resemblance to Claude Opus. Still, the pattern is enough to add fuel to an already-burning debate about whether the intelligence in some of today’s cheapest models was earned or simply copied.

The Security Angle: Secrets Hiding in Plain “Thought”

Before you fixate on geopolitics, fixate on your own API keys. The same technique that exposed hidden reasoning also recovered personal information — passwords and API keys — that had gotten swept into a model’s chain of thought. “All major frontier model providers we tested share this vulnerability,” Panfilov told WIRED. “It can lead to personal information leakage, and it enables large-scale reasoning distillation attacks.”

The team disclosed the flaw to OpenAI, Anthropic, and Google last month, and each has patched the personal-data leak. But Panfilov says fully closing the distillation loophole would require “a fundamental overhaul” of how these APIs work. Anthropic said it “values independent research” and has built “short-term mitigations” for the behavior; Google and OpenAI both declined to comment.

The Distillation Wars: OpenAI, Anthropic, and the Chinese Labs

Distillation itself is legal and standard practice — so standard that Meta’s Mark Zuckerberg called it “an important principle of how the open source ecosystem works” and warned that restricting it would put the US at a disadvantage. But it has become a geopolitical flashpoint. OpenAI told US lawmakers in February that DeepSeek appeared to copy one of its models to build its R1 reasoning model; in June, Anthropic told lawmakers that Alibaba systematically distilled its models to build Qwen.

Not everyone thinks the sky is falling. Kyle Miller of the Center for Security and Emerging Technologies told WIRED that distillation only boosts a model’s capabilities to a limited degree, and that Chinese labs have the expertise to build frontier models from scratch: “If you removed the ability for Chinese labs to distill, it’s my view that it wouldn’t dramatically change the competitive landscape.” Oxford’s Yarin Gal goes further, arguing that distillation has actually sped up progress: “If it’s the norm that everyone blocks everyone, then that also will have implications on the rate of progress.”

What It Means for Choosing AI Models in 2026

You don’t need a security clearance to feel the ripple effects of this research. If you’re shopping for an AI model or tool this year, a few practical lessons stand out:

• Provenance matters. A model’s benchmark score tells you how smart it acts — not whether it earned that intelligence or distilled it from a competitor. When a new open-weight model suddenly rivals a frontier leader at a fraction of the price, provenance is a fair question to ask.
• Open weight does not mean independent. “Open” describes how a model is distributed, not how it was trained. An open-weight model can still be built on distilled reasoning from a closed one — which matters for licensing, reliability, and trust.
• Mind your secrets in prompts. If reasoning traces can be recovered, treat every prompt as if it could echo back. Don’t paste production credentials, customer PII, or source code you can’t afford to leak into a model’s context — especially with smaller model tiers that may have weaker safeguards.
• Watch the smaller models. This whole attack hinges on the fact that cheap model tiers get less alignment. “Cheaper” can quietly mean “less guarded.” Use cost-optimized tiers for low-sensitivity workloads and the hardened, aligned tiers for anything sensitive.
• The reasoning you don’t see is a feature, not a bug. Hidden chain-of-thought is what makes modern reasoning models sharp. The trade-off is that the same mechanism can leak — so pick providers that are transparent about how they handle encrypted reasoning and responsive to security disclosures.

The Bottom Line

The Tübingen research doesn’t prove that any specific lab stole anything — the authors say so explicitly. What it does prove is that the boundary companies draw between “what we show you” and “what we keep hidden” is thinner and more porous than the marketing suggests. Hidden reasoning can be recovered, secrets can ride along inside it, and the global race to build cheaper models keeps blurring the line between genuine innovation and clever copying.

For anyone choosing AI tools in 2026, the practical upshot is to treat model selection a little more like vendor due diligence: ask where the intelligence came from, keep secrets out of prompts, and don’t assume that a low price plus a high score tells the whole story. The most useful AI tool is still the one you can trust — and trust, in 2026, increasingly means understanding what’s happening inside the black box.

Frequently Asked Questions