This is a neat attack against those encrypted reasoning blocks you get back from APIs like OpenAI and Gemini and Anthropic:

> We take a trace produced by a frontier model, replay it into a weaker sibling, jailbreak the weaker model, and recover the stronger model’s hidden reasoning in plaintext.

Should be easy for them to fix though: switch up the encryption key so it only works with the API for each specific model, rather than being shared across all of their models.

And indeed, the paper says it's been fixed by all three providers (though no news on how they fixed it):

> All model providers acknowledged the receipt of our report and subsequently we were unable to launch the same attacks.