Max Planck Study Exposes Technique to Extract Hidden Reasoning Traces from Major AI APIs

·1 views

Researchers at the Max Planck Institute for Informatics in Germany have published a paper revealing methods to extract hidden reasoning traces from closed-source AI models including Claude, GPT, Gemini, and Kimi. The technique uses prefilling, prompt injection, and conversation history manipulation — combined with a smaller model from the same provider family — to reconstruct internal chain-of-thought processes that companies deliberately conceal. Token count matching confirmed near-100% accuracy in decoding hidden thinking traces across all tested systems. The study identified over 300 instances of data leakage, privacy breaches, and side-channel attacks from 300,000 test queries, and found evidence suggesting Kimi may have been distilled from Claude. The findings raise serious concerns about user data privacy and the security assumptions underlying proprietary AI systems.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Progressive tool schema deferral cut AI agent costs 21% but hurt one task type

A developer tested progressive disclosure on an AI agent with 20 tools, finding that deferring tool schemas reduced input tokens by roughly 30% and overall costs by about 21% across 80 runs. Three of the four business task types saw savings between 21% and 30%, while the fourth task showed no savings on one transport and cost 12.3% more on another. The experiment used GPT-4o at temperature zero across both Chat Completions and Responses API transports, with all runs completed on August 6, 2026, at a total cost of under 28 cents. Deeper analysis revealed that token variability under deferral stemmed from differences between task types rather than run-to-run randomness, with some tasks consistently loading far more schemas than others. The findings suggest that mean cost reduction is a misleading metric when evaluating schema deferral, and per-task breakdown is essential before deploying the optimization in production.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Build Production-Ready AI Agents With JavaScript and React

Building AI agents with JavaScript and React is relatively straightforward at the prototype stage, but moving to production introduces significant additional requirements. Key production concerns include full observability — logging every tool call, model response, and state transition — as well as robust error handling, timeouts, circuit breaking, and rate limiting. Tool design and the React interface also need to evolve beyond minimal development setups to handle real-world complexity. Experts recommend implementing observability first, before adding any advanced agent functionality. A dedicated session on this topic will be presented by Marc Gusmano of Sencha at JS Days 2026, a free virtual conference scheduled for September 16–17, 2026.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Single Non-ASCII Character 'Ö' in Directory Path Broke Four Dev Toolchains

On July 26, 2026, a developer working on a Flutter and .NET project discovered that a single uppercase non-ASCII character, 'Ö', in the parent directory path was causing failures across four separate toolchains. The affected tools included Dart's build_runner, Flutter's language server analyzer, the Android Gradle Plugin, and a PowerShell script, each producing distinct and seemingly unrelated error messages. Isolation testing confirmed the character alone was responsible: an identical path with 'Ö' added returned exit code 255, while the same path without it built successfully. A Windows directory junction to a clean ASCII path resolved most toolchain failures, but the Android Gradle Plugin still crashed because it resolved the junction back to the original non-ASCII physical path. The incident highlights the importance of single-variable debugging and the underappreciated risk of non-ASCII characters in development directory paths on Windows.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

One-Line Import Fix in Bazable v1.2.0 Resolves CLI Crash Affecting All Commands

Bazable, a Git-native API contract management CLI, suffered a startup crash after the Language Server Protocol (LSP) feature was introduced. Every command, including bazable --version, failed with an ERR_PACKAGE_PATH_NOT_EXPORTED error because the LSP module was loaded at boot. The root cause was an incorrect import path using vscode-languageserver/node.js instead of the documented vscode-languageserver/node subpath, which ES modules do not permit when the package exports field does not define it. Developers fixed the issue with a single-line import correction and also added a --stdio flag to improve manual LSP testing. The patch was shipped in Bazable v1.2.0, immediately restoring full CLI functionality for all users.

0 comments Read more at DEV Community