AI providers seal a model's hidden thinking in encrypted blocks, but a cheaper model can apparently open them and read it back.

This explores how the sealed "reasoning blocks" some AI providers hand back to you can be swapped between models from the same provider, so that a cheaper, less-guarded model ends up reading a stronger model's hidden thinking. The provider encrypts a model's reasoning so you can't read it, but you send it back with your next request so the model can pick up where it left off. The catch, from Can cheaper models decrypt traces from stronger models?, is that these blocks are interchangeable across models and sessions within a provider. Nothing ties a block to the model that wrote it.

That makes the attack a simple swap. Take a block produced by the strong model, hand it to a weaker model from the same provider, and ask for it back. The weaker model can decode the block and print the stronger model's trace verbatim. The weaker model matters because it is less safeguarded, so the strong model's protections don't travel with the block. This breaks anti-distillation protections, which hide traces so competitors can't train on them. It also allows large-scale extraction of any private data embedded in the hidden reasoning.

The corpus treats this as a provenance problem that shows up in other places too. Can attackers manipulate which model handles a request? argues that the layer deciding which model handles a request sits beneath prompt-level defenses. Attackers can steer requests to weaker models, or cause safety measures to operate on the wrong identity. Interchangeable blocks are the same weakness seen from the data side. The system never checks which model a piece of content was meant for, so in effect the weakest model in the family sets the protection level for everything the family produces.

Two other notes explain why protecting the strong model isn't enough. Can a model-level filter truly contain an agent with environment access? makes the point that a filter judges one output at one moment, while real risk spreads across everything an agent can touch. A sealed block is an artifact that leaves the model and moves around, so safeguards on what the strong model says do nothing once the block is in someone else's hands. Can commitments protect sensitive agent data while enabling verification? shows a contrasting design. There, commitments prove what happened without exposing the sensitive content, so proof and disclosure are kept apart. Encrypted reasoning blocks have to stay readable to the provider's models, and interchangeability shows that "any model from the provider" is too broad a key.

The corpus describes the attack but doesn't spell out a fix. The related notes point toward binding each block to its origin model and session, and verifying which model actually handles each request.