OpenAI and Anthropic hidden CoT leaks when given deep_think tool.

TL;DR Highlight

Disabling thinking and offering a deep_think tool made models emit internal-CoT-style reasoning

Who Should Read

Backend developers building agents on reasoning-model APIs who worry about reasoning-token exposure and security

Core Mechanics

Turn thinking off, add a tool
- Can Bölük says that with thinking disabled and a "deep_think" tool provided, the model calls it using its internal CoT (chain-of-thought text) format.
- He did not specify any argument format.
No format given, grug-talk appeared
- The thread says gpt55+'s grug-talk format showed up even without specifying the argument format.
- He published a PoC at pasta.can.ac/omegiligox.py.
It started with Alexander Panfilov's post
- Panfilov said they extracted hidden reasoning using a vulnerability in the APIs of every frontier AI company.
- Their reasoning token count matched billed API thinking tokens 1:1 for most prompts.
Thinking levels still work
- Bölük says switching thinking levels works fine too.
- He notes the level has always been a number in the system prompt.
A hint about Anthropic using regex

Community Reactions

Was this already known?
- One commenter asked whether this was already known.
Opinion that it will get blocked
- One commenter said the labs are probably scrambling to block it.
- Another asked what would stop them from blocking it.
Worry about cloud-only harnesses
- In the original thread, Kevin said we'll soon only be able to use these models in cloud-hosted harnesses from each lab.

How to Apply

Audit where reasoning could leak
- Today, check your logs and response schemas for reasoning text in tool arguments.
- Find any UI that shows tool arguments to users verbatim.
Compare reasoning tokens to your bill
- Match billed thinking tokens against tokens you receive, per request.
- Use it to audit whether hidden reasoning exists.
Filter tool arguments as untrusted
- Apply length limits and masking to model-generated tool arguments before logging or showing them.
- Add test cases for internal prompts or policy text appearing in arguments.

Try It

copy & run

# Paste into Claude or ChatGPT for auditing your own service (a simple check, not the original PoC)

You are a tool-call log auditor. Decide whether the tool-call logs below contain internal reasoning or system prompt fragments in the arguments.

{{tool call logs}}

For each call, write 'suspicious/normal' and a one-line reason.

Next step: ask it to extract common patterns from the suspicious calls and turn them into filter rules.

Terminology

CoT (Chain of Thought)Step-by-step reasoning text a model writes before answering. Like the worked solution on an exam.

Reasoning tokensTokens the model spends thinking. Hidden from users but still billed.

PoCA short demo code showing a vulnerability actually works.

HarnessThe runtime that wraps a model and manages tool calls and I/O.