Disabling thinking and exposing deep_think as a tool leaks the internal CoT reasoning format

TL;DR

@_can1357 demonstrates a simple jailbreak-style prompt trick against frontier “thinking” LLMs: disable native thinking mode and instead expose a tool named deep_think. When the model reaches for reasoning, it calls the tool — and because nothing constrains the argument format, the tool call payload contains the model’s internal CoT format verbatim (including provider-specific conventions like “grug-talk” for GPT-5.5-class models). A PoC script is linked (pasta.can.ac/omegiligox.py). The author notes that thinking levels have always been just a number in the system prompt, so switching them works too.

Key claims

Disabling built-in thinking and offering a deep_think tool causes the model to route its chain-of-thought through the tool arguments, exposing the raw internal reasoning format [tweet].
No explicit specification of the argument schema is needed — the model spontaneously emits the provider’s characteristic internal format (e.g., “grug-talk” from GPT-5.5-class models) [tweet].
Thinking “level” is a number in the system prompt, so switching thinking levels works via the same mechanism [tweet].
Anthropic’s regex-based defenses missed this vector (“fable btw, anthropic usually has great regex game”) [tweet].

Method

The technique consists of two prompt-level moves: (1) turn off the model’s native reasoning stream via whatever standard toggle the provider exposes; (2) declare a synthetic tool called deep_think with an underspecified argument (no schema constraint on the reasoning payload). When the model would normally reason, it invokes the tool, and the argument string contains the internal CoT in its native format. The linked PoC (pasta.can.ac/omegiligox.py) is a single-file demo. Because the technique doesn’t require model access or fine-tuning, it’s applicable to any deployed thinking model with tool use enabled.

Results

Anecdotal only — this is a tweet, not a paper. The author provides a PoC and screenshots showing extraction from a GPT-5.5-class model in “grug-talk” internal format. No systematic evaluation, model coverage, or mitigation study.

Why it’s interesting

This is a small but pointed jailbreak observation: reasoning-model providers gate CoT visibility for safety and IP reasons, and this bypass sidesteps the gate purely through tool-use surface area rather than through any prompt-injection payload. It’s adjacent to the “tool-use as capability leak” discussions in Tool-Use Agents — most work there treats tools as capability additions, but this treats a synthetic tool as an exfiltration channel for latent model state. Contrasts with the recent Natural Emergent Misalignment from Reward Hacking in Production RL observation that reward-hacking behaviors emerge naturally in production RL: here the surface used isn’t reward hacking but a schema-free tool argument, and the “misuse” is entirely user-side prompt engineering.