SAN FRANCISCO — Three of the industry's largest model providers have a shared problem, and it isn't competitive position. Security researchers this week disclosed a vulnerability affecting OpenAI, Anthropic, and Google LLM APIs that exposes hidden reasoning traces — the internal chain-of-thought these models generate before producing a final answer.
That matters more than a typical bug. Reasoning traces are supposed to be the walled-off scratch paper. Labs hide them partly to prevent competitors from reverse-engineering training methodology, and partly because the raw reasoning sometimes contains content the polished output is designed to filter out. A leak doesn't just expose a security hole. It exposes IP.
The timing is inconvenient. Anthropic has reportedly moved up its release schedule, with Opus 5.5 said to be skipping ahead of plan, while Google's Gemini 4 Pro has been spotted in stealth testing, according to a BigGo Finance report tracking the accelerating release cadence. Both companies are shipping faster, not slower, than they were a year ago. A reasoning-trace leak occurring mid-sprint is the kind of thing that normally triggers an engineering freeze, not shrug and ship.
There's a second narrative running parallel to this: the theory, gaining traction this week, that Google's early-2023 stumble in the AI race wasn't a model-quality problem but an organizational one — a thesis explored in a widely circulated piece arguing Google "fell out" of the race for reasons distinct from raw capability. If true, Gemini 4 Pro's stealth appearance now is less a comeback story than a correction of a process failure — which is a more durable kind of fix than a model refresh.
Three labs, one exposed scratch pad, and a race that isn't slowing down to patch it.