AI
How reasoning blocks work and how providers protect them
Reasoning models (Anthropic’s Claude, OpenAI’s o-series) emit thinking blocks — special tokens generated before the final answer that enrich the model’s context and sharpen its response. Because those tokens feed directly into what the model says next, providers protect them with cryptography. Anthropic and OpenAI either encrypt the block or attach an HMAC signature. Tamper with the block and the API rejects the message.
“you can actually force models to think more or less what you want them to think” — Jackson Reed
The check exists. The gap is in what it checks.
The critical gap — providers only verify origin, not context
The crypto signature does one thing: it confirms a model from the provider produced the block. That’s the entire check. Neither Anthropic nor OpenAI binds the block to the current conversation or to a specific API key.
“did a model from our provider actually think this ever” — Jackson Reed
That single question is the gap. A valid block from any prior session, on any account, passes the check. The provider verified origin. Context was never part of the contract.
Live demo — injecting harvested reasoning into a foreign conversation
Reed copies the reasoning block from a completed Île-de-France query, injects it into an unrelated Occitanie query on a different API key, and strips out the original Toulouse thinking. Replay reasoning block across conversations (01:50) He then asks the model what it was thinking before answering. The model confesses injected thoughts as its own (02:29):
“Hey, oops, I was wrong. I briefly started thinking about Paris before I gave you the right answer. This is a weird mistake. My bad.”
The model never thought about Paris. That thought came from a different conversation entirely.
Q&A
Do you know why they don’t pin the thought to the conversation? Reed’s theory is that context-locking was missed in threat modeling — OpenAI and Anthropic focused on verifying the block came from their provider and never went further, and the crypto check may never have been a security control at all, just a guard against malformed blocks. ▶ 3:24
Notable Quotes
you can actually force models to think more or less what you want them to think Jackson Reed · ▶ 0:12
did a model from our provider actually think this ever Jackson Reed · ▶ 1:38
Hey, oops, I was wrong. I briefly started thinking about Paris before I gave you the right answer. This is a weird mistake. My bad. Jackson Reed · ▶ 2:44
I think it was just like kind of missed in threat modeling Jackson Reed · ▶ 3:38
Key Takeaways
- Reasoning blocks are origin-verified but not context-locked — any valid block can be replayed into any conversation.
- Harvest thinking tokens from one query and inject them cross-conversation or cross-account to steer model behavior at inference time.
- Treat extended thinking as an untrusted, manipulable input surface, not a protected internal monologue.