Weaker Models Decoded Claude, GPT, Gemini Traces

In August 2026, researchers reported that weaker sibling models could render encrypted reasoning traces from Claude, GPT, and Gemini as plaintext. A cheaper, less capable model from the same provider became a decoder for frontier work.

The model file no longer contains the whole advantage

Weights encode reusable capability. A reasoning system creates another proprietary layer each time it runs. Its intermediate state can capture the search path it explored, the instructions that shaped its behavior, the alternatives it rejected, and the task-specific work compressed into the final answer.

That runtime layer becomes commercially meaningful when a provider sells reasoning as a premium product. Google placed Gemini 2.5 Deep Think in a $250-per-month Ultra tier and described the model as considering multiple ideas simultaneously. The customer sees the answer. Google retains the process that made the premium answer possible.

Security teams cannot equate that process with an honest transcript of cognition. Anthropic’s Alignment Science team warned that chain-of-thought may be unfaithful or strategically concealed. A plaintext trace may omit, distort, or invent a rationale.

Even an unfaithful trace can expose hidden prompts, candidate strategies, tool references, or post-training behavior. It has operational value whenever it reveals work the owner meant to restrict.

A cheap sibling can become the confused deputy

Cross-tier extraction expands the security question beyond who can download weights or call the frontier endpoint to what every authorized model in the provider’s system can understand.

Because the reported decoder came from the same provider, product architecture becomes part of the attack surface. A lower-cost endpoint may have fewer capabilities yet share enough familiarity with the provider’s artifacts to interpret them. The cheap model does not need to defeat the strong model; it only needs to understand what the strong model produced.

Inference cost and latency make this boundary unavoidable. Providers reserve expensive reasoning for the steps that need it, route routine work to cheaper models, and move suitable execution onto devices. Unit economics produced the architecture.

Gemini Robotics 2 shows the resulting shape. Google DeepMind combined several models into one robotic system while positioning an on-device model to run locally and adapt to different robot bodies. Each model serves a rational cost, latency, or deployment purpose. Each handoff also determines what the receiving component may inspect, retain, or reinterpret.

A router therefore cannot choose a model only by price, speed, and benchmark score. It must also know whether the destination model may understand the source model’s intermediate state. When both tiers participate in one workflow, a cheaper endpoint carries security authority as well as a lower price.

Agents turn trace leakage into workflow reconnaissance

AI agents increase the value of intermediate state because they reason about goals, make decisions, execute actions, and interact with external systems. Their orchestration layer coordinates models, tools, memory stores, and permissions. A trace inside that layer can reveal both what the model considered and what the system can do next.

An agent’s working state can identify which document it retrieved, which tool it selected, which credential scope it invoked, and which actions it planned. An attacker who reads that state gains a map of the workflow: where authority enters, which components trust one another, and which step offers leverage. The same disclosure can expose proprietary task logic and a path for subverting it.

OpenAI’s Agents SDK added native sandboxing and an in-distribution harness for deploying and testing agents on long-horizon tasks. Those controls address operational risks that a single prompt-response filter cannot contain. The system must govern what the agent touches while it is working.

Trace custody is therefore part of verifiable agent control. A sandbox can restrict actions, but the system also needs evidence that the model, router, and tool chain handled protected state according to policy. Capability testing asks whether an agent can complete the task; runtime custody records who learned how it did so.

Google’s portfolio needs more than one secrecy rule

Google DeepMind open-sourced WeatherNext while keeping Deep Think in the paid Ultra tier. Those choices assign different boundaries to different assets: one model serves as shared forecasting infrastructure, while another model’s reasoning supports a premium product. Product purpose determines which artifact requires enclosure.

Deep Think, Gemini Robotics, the CodeMender security agent, and cheaper Gemini variants can create more value together than any isolated checkpoint. Google must preserve the permissions between those components as deliberately as it develops their capabilities.

The router belongs inside the vault

Engineering teams can place frontier and lower-tier artifacts in separate bounded contexts, assign each trace a provenance record, and bind access to a model, session, task, and permitted purpose. A sibling model should not receive generic authority to interpret an artifact merely because both models share a provider.

Providers can then apply least privilege at every handoff. Routers should expose only the information required to select an endpoint. Tools should receive only the task state required for their action. Memory stores should separate durable user context from temporary reasoning state. Audit logs should record which model, tool, and policy touched each protected artifact.

Encryption still matters, but it cannot carry the entire policy. The cross-tier result shows why: an artifact can remain obscure to outsiders while another authorized component renders it intelligible. Providers need a compute chain of custody that controls interpretation, not merely possession.

The August result turned weaker siblings into interpreters for Claude, GPT, and Gemini. Providers split tasks across model tiers because price and latency reward it; they keep premium reasoning proprietary only when every router, tool, memory store, and sibling model has purpose-bound authority. The router belongs inside the vault.