TRACE ATLAS Get the Kimi probe ↘

Field note 01 · 12 Aug 2026

The visible edge
of thought.

Eight non-interactive runs: four supported Codex reasoning summaries and four complete plaintext think channels persisted by Kimi Code. The atlas labels them separately because they are not the same kind of evidence.

Explore the traces Read the security context
codex.jsonl + kimi.wire capture complete

01 Codex / reasoning summary

02 Kimi / plaintext think

03 both / answer + usage

8captured runs
4Codex summary runs
4Kimi plaintext runs
0envelope exploits

01 / Captures

Two clients expose two different surfaces.

Choose a run to inspect its prompt, exposed reasoning, final answer, and usage. Bars are normalized within their unit: Codex reports hidden reasoning tokens; Kimi exposes plaintext thinking, measured here in characters. Heights across those two groups are not comparable.

Loading traces…

Prompt JSONL

02 / Security context

Three meanings of “reasoning trace.”

Panfilov et al.’s 2026 preprint studies a vulnerability in opaque, client-held reasoning envelopes. It is essential context for trace hygiene—but it is not the mechanism used for either capture set in this atlas. Kimi's plaintext channel is returned by its normal client.

Read arXiv:2608.09867 ↗
Dimension Supported captures here Paper’s extraction study
Material Codex summaries; Kimi plaintext think events Reconstructed hidden reasoning from encrypted envelopes
Interface codex exec --json; Kimi session wire.jsonl Cross-session / cross-model envelope replay
Faithfulness Codex is a lossy summary; Kimi is the complete client-visible thinking field Estimated via extracted-vs-billed token counts; no plaintext ground truth
Current status Normal client output/session persistence; no envelope replay Authors say their attacks stopped reproducing after disclosure mitigations
01

Portability became an oracle

The authors report that encrypted reasoning blocks were accepted across sessions, users, and sibling models, allowing a weaker model to act as a decoder for a stronger one.

02

Privacy risk was concrete

Across 315,320 scraped blocks, the paper reports 367 PII artifacts and 182 credentials. Public “opaque” logs should therefore be treated as potentially sensitive.

03

Summaries can distort

In a manually reviewed subset (18 Opus and 15 GPT-5.6 Sol traces), the authors found omitted hedges, verification presented as derivation, and summaries containing only a trace’s tail.

04

Context binding is the repair

Proposed defenses bind envelopes to users, sessions, and order; isolate model versions; rotate legacy keys; and train models to refuse transcription-style extraction.

03 / Reproduce

A small experiment with hard boundaries.

Each prompt was run once with Codex Luna/low and once with Kimi K3/high. The Kimi extractor reads only prompt, think, answer, and usage fields from the local session. Public copies redact session IDs and exclude system prompts, credentials, tool logs, and opaque payloads.

1

Launch
Both CLIs in non-interactive streaming mode.

2

Request
Codex Luna/low and Kimi K3/high on the same prompts.

3

Capture
Codex summaries or Kimi think, plus answers and usage.

4

Sanitize
Publish only the minimum fields needed to reproduce the observation.

capture.sh
python3 scripts/kimi_trace_probe.py \
  --model kimi-code/k3 \
  --effort high \
  --label diagnostic-bayes \
  --prompt-file prompts/diagnostic_bayes.txt
Download Kimi capture source ↘

What “full” means here

For Kimi, “full” means every plaintext think field returned to and persisted by Kimi Code for that run. It cannot establish what, if anything, occurred inside the model but was never returned.

What JSONL captures

Codex's JSON stream contains summaries rather than raw thoughts. Kimi's public stream JSON omits thinking, while its local session wire.jsonl retains the client-visible think event used in these sanitized captures.

Why traces are sanitized

The paper shows that raw agent logs can carry sensitive opaque state. Publish the minimum useful surface: prompts, summaries, answers, actions, and aggregate usage—not replayable private envelopes.

Sources

  1. Panfilov, A., Schmotz, D., Shumailov, I., Beurer-Kellner, L., Schaeffer, J., Prabhu, A., Geiping, J., & Andriushchenko, M. (2026). Stealing Reasoning Traces from Proprietary LLM APIs. arXiv:2608.09867. Abstract · PDF
  2. OpenAI. Codex non-interactive mode. Documentation
  3. OpenAI. Codex configuration reference: reasoning summaries. Documentation
  4. OpenAI. Reasoning models and token accounting. Documentation
  5. Moonshot AI. Kimi Code sessions and wire event persistence. Documentation
  6. Moonshot AI. Kimi command output formats. Documentation