The reasoning inside AI models can be moved. Here is why that matters.

Security researchers published findings this week that deserve more attention than they are getting outside of infosec circles. They demonstrated that the encrypted reasoning traces generated by major AI APIs, including those from OpenAI, Anthropic, and Google, can be extracted and transferred between models. In plain terms: the hidden thinking that a model does before it answers can be pulled out and handed to a different model, which can then use it.

This is not a minor footnote. It changes several things we thought were settled about how these systems work, who controls what, and what it means to build a product or a workflow on top of a commercial AI API.

What reasoning traces actually are

When you call a model like o3, Claude Sonnet, or Gemini Advanced, what comes back is not just one forward pass through the network. The model reasons first. It works through intermediate steps, often called chain-of-thought, before it produces the final response. These traces are typically hidden from the end user. The API returns the answer. The reasoning stays behind glass.

The providers encrypt these traces deliberately. The argument from their side is partly practical: showing raw internal reasoning to users can confuse more than it clarifies. But there is also a competitive dimension. The way a model reasons is a meaningful part of its differentiated capability. OpenAI and Anthropic have both been careful about how much of this they expose.

What researchers found is that the encryption is not as opaque as assumed. The traces can be recovered. And once you have them, they are transferable. You can feed the extracted reasoning from one model into a prompt for a different model and meaningfully improve that model's output on the same task.

What this actually breaks

Three things shift when reasoning traces become portable.

Provider lock-in looks different. If you are building on GPT-4o and the output quality matters partly because of how that specific model reasons through your domain, the finding suggests that reasoning process is not permanently fenced off. You could, in principle, extract traces from your existing provider and use them to train or prompt a cheaper model on the same reasoning pattern. That is interesting to anyone managing API costs at scale.

The trust model around confidential prompts weakens. Agencies and product teams routinely push sensitive context into system prompts: client briefs, proprietary frameworks, product specs. The assumption has been that what goes into the API stays inside a controlled environment. If reasoning traces can be extracted, you now have an additional surface area to think about. Not because the model is malicious. Because the extraction is possible.

Benchmarks mean less than we thought. If reasoning from a high-performing model can be ported to a lower-ranked one and close the gap, performance benchmarks tied to specific models become a weaker signal. The question shifts from which model performs best to who controls the reasoning infrastructure underneath the answer.

The agency angle

For studios like ours, and for the product teams and founders we work with, this matters in a specific way.

A lot of agency differentiation in the AI era has been quietly built on top of prompt craft and model selection. We pick the right model for the task, we engineer a system prompt that reflects accumulated knowledge about the client's domain, and we build a workflow that ties it together. That is real work. It is not nothing. But if the reasoning inside the model is now more mobile than we assumed, the durability of that differentiation is worth revisiting.

The studios and teams that will hold ground are the ones building proprietary data loops rather than proprietary prompts alone. Context that comes from your client's actual operations, feedback that reshapes outputs over time, structured data that a generic model cannot replicate from a prompt alone. That is the part that does not transfer when someone extracts a reasoning trace.

There is also a shorter-term operational point. If you are running sensitive client work through commercial APIs, add reasoning trace exposure to your threat model now. It does not mean stop using the APIs. It means design your data architecture with that surface in mind.

What providers will probably do next

The major providers will respond. They always do when a meaningful capability boundary gets probed publicly. The most likely moves are tighter sandboxing of trace generation, rate limiting on the API patterns that enable extraction at scale, and more granular access tiers that separate reasoning-heavy calls from standard completions.

Anthropics's extended thinking feature, which exposes a version of chain-of-thought deliberately, is an interesting contrast here. They chose visibility on their terms. The researchers found a way to get it without those terms. The difference matters commercially, even if the underlying information is similar.

What providers will not do is make their reasoning fully auditable. The competitive pressure runs the other way. But they will patch the most obvious extraction vectors, and they will do it quickly.

The underlying shift

This finding is a useful stress test for a belief that has been floating around AI circles for a while: that the intelligence is in the model, and we are just accessing it. What it actually reveals is that reasoning is a resource that can be decoupled from the model that generated it. That is a more interesting and more unsettling frame.

For anyone building on top of commercial AI, the question to sit with is not which model has the best reasoning. It is what you own in the stack that is genuinely yours. Data. Relationships. Domain knowledge that took years to accumulate. Workflows that encode how a specific team actually thinks.

The models are increasingly capable and increasingly commoditised at the same time. Reasoning traces being portable accelerates both of those trends. The studios and product teams that understand that early will build differently than the ones still treating model selection as a strategy.