The report
An attacker does not need access to an assistant's private reasoning channel to write text that looks like reasoning. A November study tested whether externally supplied tags and reasoning-like prose could steer model outputs and agents past ordinary instructions.
Two different experiments
In the first experiment, researchers placed fictional financial records in protected context and tested prompt variants against three models. Across 6,000 runs, 629 disclosed at least some protected synthetic material. Of the leaking runs, 67.7% exposed it in the final answer alone, 20.8% in a reasoning-related output alone and 11.4% in both. Those percentages partition the leaking runs; they are not three independent 6,000-run success rates. Relative effects of explicit tags differed by model.
The second experiment used an agent legitimately reading a document and let the attacker alter the document's content. Fake internal reasoning text in that lower-trust document attempted to induce unauthorized tool actions, including a reverse-shell test and a Git backdoor. Some model and payload combinations succeeded in the controlled range even where ordinary user-style malicious instructions had failed. The exact numbers depended on model-specific wording and tag placement, rather than representing one universal attack probability. The research Case keeps the direct-disclosure and tool-effect experiments separate.
The mechanism is authority imitation through the reading surface. The document is legitimate task data, but a passage written as though it were the model's own computation is still document content. The model may treat its formatting or detailed action plan as more authoritative than a normal untrusted instruction. Successful simulated shell or Git effects show why text filters alone cannot stand in for authorization of real tool calls.
No public customer secret theft or confirmed deployed backdoor is established by the study. A safer design identifies the provenance of every tool-affecting instruction and checks the destination, argument and permitted side effect outside the model, regardless of whether the triggering text resembles hidden reasoning. Testing should include normal-task completion, since a defense that blocks every document action also fails the legitimate task.