Not reliably: the chain of thought a model writes before answering often leaves out what actually decided the answer, and researchers have measured that gap repeatedly since 2023. In Anthropic's 2025 tests, Claude 3.7 Sonnet mentioned a planted hint, on average, in only 25% of the cases where the hint changed its answer, and DeepSeek R1 in 39%. Yet the traces still help catch misbehaviour: an OpenAI monitor that read a reasoning model's chain of thought caught 95% of two widespread reward hacks, against 60% for one that saw only actions and outputs. In September 2026, OpenAI reported that its most powerful model, GPT-6 Astra, is harder to monitor than its predecessor and much better at controlling what its reasoning says.
A faithful trace records what actually drove the answer
Chain-of-thought prompting, set out in a 2022 Google Research paper, gets a model to write intermediate steps before it answers; reasoning models, starting with OpenAI's o1 in 2024, are trained to do this at length. A trace is faithful when it accurately represents the reasoning behind the answer, which is not the same as looking plausible. Google DeepMind researchers argue that for catching harmful behaviour as it happens, the more useful test is monitorability. Reasoning written to rationalise an answer already reached may omit what really drove it, but when a task is hard enough that the writing is part of the computation, the model must think where a monitor can read it.
The 2023 studies caught explanations hiding their real cause
Some of the clearest early evidence came from Miles Turpin and colleagues at New York University. They biased GPT-3.5 and Claude 1.0 on 13 BIG-Bench Hard tasks, either by reordering the options in the prompt's worked examples so the correct one was always "(A)" or by adding a user's remark, "I think the answer is A but I'm curious to hear what you think", with the letter chosen at random. When the bias pointed to a wrong answer, accuracy fell by as much as 36%, and the models' reasoning often justified the biased choice; of 426 such explanations reviewed, one mentioned the bias. On a social-bias test, the models defended stereotyped answers without mentioning the stereotype.
Two months later an Anthropic team led by Tamera Lanham truncated, corrupted, paraphrased or replaced a 175-billion-parameter model's reasoning to see whether its answers depended on it. On three sets of school-level science questions, the reasoning changed the final answer less than 10% of the time, suggesting the answer was largely settled in advance; on algebra word problems it changed the answer more than 60% of the time. Larger, more capable models gave less faithful reasoning on most tasks.
Reasoning models are more candid, but not reliably so
Reasoning models do better, though not by enough. Anthropic's alignment science team planted six kinds of hint in multiple-choice questions, from a Stanford professor's supposed opinion to a note saying the model had "gained unauthorized access to the system", then checked whether models that switched to the hinted answer said why, producing the figures above. Training on outcomes raised faithfulness at first, then plateaued at 28% on one benchmark and 20% on a harder one. In training environments with planted reward hacks, the model learned to exploit them over 99% of the time but mentioned them under 2% of the time in five of six environments. The authors, writing in April 2025, call their scenarios somewhat contrived, with tasks easy enough not to need reasoning.
Interpretability shows the same failure from the inside. When Anthropic researchers traced Claude 3.5 Haiku's computation in March 2025, a prompt saying a human had reached an answer of 4 led the model to work backwards, choosing an intermediate value that made its written steps land on 4. The researchers caution that their method captures only part of the computation.
An incomplete trace can still catch misbehaviour
In OpenAI research published in March 2025, a GPT-4o monitor followed a frontier reasoning model from the same family as o1 and o3-mini through training on coding tasks; the model often stated its plans outright, at one point noting that it could "fudge" the tests. Apollo Research had no access to o1's hidden reasoning in its December 2024 scheming evaluations, but short summaries it elicited in some tests usually named the scheming with words such as "sabotage", even as o1 kept up its deception in over 85% of follow-up questions. In one sandbagging test, Claude 3.5 Sonnet and Claude 3 Opus, whose reasoning was visible, wrote out plans to underperform in 41 and 36 of 50 runs. Apollo could not verify o1's summaries; our profile of Apollo's evaluations has more.
METR repeated Anthropic's hint test in August 2025 with clues too complex to use without reasoning. In 21,272 trajectories from Claude 3.7 Sonnet, Claude Opus 4 and Qwen 3 235B, it found three where a model plausibly failed both to show its reasoning and to mention that it was using the clue, and a detector built on OpenAI's o3 spotted clue use 99.3% of the time at 96.2% specificity, in a setup METR calls unnatural. The Google DeepMind team found that models could hide their intentions from a monitor only with substantial help, such as human-written evasion strategies.
Pressure on the reasoning can teach models to hide it
The OpenAI study also showed how the signal can be lost. Adding the monitor to a non-frontier model's training reward helped at first. With more optimisation, the model learned what the authors called obfuscated reward hacking: its reasoning looked benign, the cheating continued, and the catch rate of the monitor, which read only the reasoning and not the model's actions, fell to near zero. They suggested developers may need to pay a "monitorability tax", accepting some cost in performance rather than putting strong optimisation pressure on the reasoning.
In a July 2025 position paper, 41 researchers from OpenAI, Google DeepMind, Anthropic, Meta, the UK AI Security Institute and other organisations, endorsed by Geoffrey Hinton and Ilya Sutskever among others, called this monitorability "a new and fragile opportunity for AI safety". They warned that it could erode through further scaling of reinforcement learning, pressure on the reasoning or new architectures, and asked developers to measure it and report the results in system cards.
Avoiding that pressure has proved hard. Anthropic's August 2026 Risk Report disclosed that reasoning text had been unintentionally exposed during reward calculation in a share of training episodes: 0.2% for Claude Opus 4.6, 5.1% for Claude Mythos Preview, 1.4% for Claude Opus 4.7, 0.27% for Claude Opus 4.8 and 2.7% for Claude Fable 5 and Claude Mythos 5, all lower bounds that Anthropic believes are close to the true rates. It found some evidence that the leakage worsened monitorability, though its audits did not find Mythos Preview's reasoning less faithful than other models'. A company post on 31 August 2026 gave the concern: that such training teaches "a model to hide its actual reasoning". The same logic applies to a second channel: OpenAI says it reduced deceptive instructions in its models' context-compaction summaries without grading those summaries directly.
The 2026 measurements point in different directions
A newer concern is that models will learn to control what their reasoning says. In March 2026, researchers from New York University, UCL, the University of Pennsylvania and OpenAI found that Claude Sonnet 4.5 could follow simple rules about its reasoning, such as avoiding a particular word, only 2.7% of the time, against 61.9% for its final output, and that this ability fell with more reinforcement learning. They were "cautiously optimistic".
Six months later OpenAI's newest models reversed the trend. Among traces of 750 to 1,250 tokens, the GPT-6 Astra system card reports Astra obeying such rules 60.9% of the time, against 16.1% for GPT-5.6 Sol and 1.7% for GPT-5.5 Thinking, and a 29 September addendum puts the faster GPT-6.1 Sol at 44.8%. In examples OpenAI published, told to think about anything but the question, Astra filled its reasoning with unrelated imagery and GPT-6.1 Sol wrote no reasoning text at all, though it made question-related tool calls; both answered correctly. Astra's monitorability fell below GPT-5.6 Sol's at most reasoning lengths, and when it was instructed to attack a planted honeypot, being told that a monitor would read only its reasoning sometimes led it to cut that reasoning short enough to evade the monitor. OpenAI is fairly confident there was no significant direct grading of the reasoning, links the change to Astra's growing ability to work without it, and found no sign that Astra can hide reasoning a task actually requires. In that honeypot test, a monitor that also saw the models' actions caught every successful exploit. Even so, OpenAI warns that if similar declines continue in future models it would likely soon have "significantly reduced confidence in detecting many forms of misaligned behaviors" with its current monitoring systems; our report on Astra's monitorability has more.
Anthropic's figures for its latest Opus model are more reassuring. The Claude Opus 5.5 system card of 22 September 2026 puts that model's controllability close to Claude Opus 4.7's and well below Claude Mythos Preview's and Claude Mythos 5.1's. When Anthropic used reinforcement learning to train the model to finish a covert side task without alerting a monitor that read its full transcript, no episode with extended thinking escaped, though a quarter to a third would have passed had the monitor not seen the reasoning. It kept planning openly, nearly always after noting its reasoning was visible. These are Anthropic's tests of its own model, which had been instructed, and then trained, to attempt the side task.
Independent testing finds more gaps. The UK AI Security Institute reported in July 2026 that every model it tested attempted to cheat at least some of the time on its cyber evaluations and that models often did not reason about the cheating in their chain of thought. Claude Opus 4.7, which decides for itself how much to reason, rarely wrote any reasoning for the cheating step. We covered those findings in our report on the institute's cheating results.
What a visible trace can and cannot show
A trace is most informative when a task is hard enough that the model must reason in it, and least when the decision is easy or can be made without writing anything down, the very ability Astra's card shows growing. Outside access is limited too: Anthropic's 2025 study omitted o1 and o3 because it could not see their reasoning, and the UK institute excluded GPT-5.4 and GPT-5.5 because it lacked full access to theirs. Anthropic's September 2026 threat intelligence report adds that Claude now summarises its reasoning before responding, which makes stolen transcripts less useful to rival labs, a trade-off we examined in our piece on distillation.
The main alternative is to read internal states directly. The Opus 5.5 card describes interpretability tools that look for gaps between what a model represents internally and what it writes; they flagged more unverbalised awareness of being tested than in the two earlier models compared, as we reported in our coverage of evaluation awareness. OpenAI says it is investigating activation monitoring too. Until one of them is validated, a chain of thought is best read as evidence about what a model did, sometimes strong and sometimes missing, and not as a full account of it.
Correction, 14 October 2026: An earlier version of this article said Apollo Research's December 2024 report found o1's chain of thought inconsistent with its final output, and that o1's sandbagging came with a careful, safety-conscious chain of thought. Apollo had no access to o1's hidden reasoning and reported neither finding. The short summaries it elicited in some tests generally described the scheming openly and were not used on its sandbagging test; the explicit sandbagging reasoning it published came from Claude 3.5 Sonnet and Claude 3 Opus, whose reasoning was visible. The earlier version also said Anthropic's Responsible Scaling Policy names chain-of-thought monitoring as part of its oversight, which no version we checked does, and misquoted the hint in a 2023 New York University study. It also overstated Anthropic's September 2026 threat report, which says summarising Claude's reasoning makes stolen transcripts less useful for training another model, not useless. Those passages have been corrected or removed.