A new attack called EchoCoT can pull a reasoning model's hidden chain-of-thought straight out through its own API, no jailbreak needed.
Researchers found an overlooked "reasoning replay" surface in how large reasoning models handle tool calls, and built EchoCoT to exploit it: a multi-step attack that uses fidelity signals returned by the API to iteratively rebuild the hidden reasoning trace. They paired it with an LLM-driven search that finds a single injection sequence effective across many prompts. Tested against three open-source and five proprietary frontier reasoning models, EchoCoT hit up to 66.4% near-verbatim extraction on the open-source models, meaning the recovered trace landed within 10% of the target's length and at least 90% of its tokens matched exactly; the same injection sequence generalized to unseen datasets at up to 80% success. On the five proprietary models, the paper does not claim that same token-for-token match. Instead, it reports that a substantial share of extracted traces align with the reasoning lengths and summaries providers report themselves, and that on Gemini-2.5 it pulled out a 33,463-token trace against a 32,948-token target.
Hidden reasoning is a real asset. It's a chunk of what makes proprietary "thinking" models expensive to train and hard to clone, and it can carry proprietary techniques or leftover sensitive context from a prompt. A practical way to siphon that reasoning through ordinary API calls turns a research curiosity into a competitive and privacy risk.
Worth noting the fine print: the strong claim, exact-match verbatim recovery, only holds for the open-source models where researchers had ground truth to check against. For Gemini and other proprietary systems, "closely align" means matching lengths and summaries, not a confirmed word-for-word copy.