AI models can't stop thinking out loud. That's both good news and a nightmare for safety.

Chain-of-thought reasoning, a model articulating its step-by-step logic before producing a final answer, has become central to the safety case for modern AI systems. The promise is simple: if we can read what the model is thinking, we can catch misbehavior before it manifests in an output. But that promise rests on a critical assumption: that the model cannot deliberately manipulate what it verbalizes in its reasoning trace.

A new paper from researchers who have developed the CoT-Control evaluation suite puts that assumption to the test. Their findings are simultaneously encouraging and disconcerting.

The controllability gap

The researchers designed tasks requiring models to solve problems while adhering to specific instructions about their chain-of-thought. For instance, reasoning through a genetics question without using the word 'chromosome.' The measure is CoT controllability: the ability of a model to comply with constraints on its reasoning process.

The headline figure is stark. Claude Sonnet 4.5, one of the most capable reasoning models available, can control its chain-of-thought only 2.7% of the time. Yet when asked to control its final output rather than its reasoning trace, that figure jumps to 61.9%. The gap between what models can suppress in their thinking versus their output is enormous.

This is not a trivial lab curiosity. If a model could freely control its CoT to evade monitoring while still producing the desired final output, the entire premise of CoT-based safety monitoring would crumble. A model that can think one thing and say another is a model that can deceive oversight mechanisms.

What drives controllability, and what doesn't

The paper systematically probes the factors that influence CoT controllability. The results challenge several intuitive assumptions.

Larger models exhibit higher controllability, an unsurprising finding consistent with the general correlation between model scale and capability. But the relationship is nuanced: gains in controllability appear to plateau beyond a certain size threshold rather than scaling linearly.

More interesting is the effect of training methodology. Models that undergo more reinforcement learning training, particularly with test-time compute scaling, show lower CoT controllability. This is counterintuitive: RL training is designed to improve task performance and instruction following, yet seems to make models less able to constrain their reasoning traces. One interpretation is that RL training internalizes reasoning patterns deeply, making them harder to override at the generation level.

Problem difficulty also plays a significant role. As tasks become harder, CoT controllability degrades further. When a model is struggling to reach the correct answer, it appears to have fewer cognitive resources left to police the form of its reasoning. This creates a perverse situation: precisely when a model is most likely to resort to undesirable reasoning strategies, on difficult, high-stakes problems, its reasoning trace becomes hardest to control and least reliable as a window into its actual process.

The monitoring paradox

The researchers found that telling models they are being monitored produces a modest but measurable increase in CoT controllability. This is a double-edged result. On one hand, it suggests that explicit monitoring can align a model's reasoning behavior with expectations. On the other, it raises the possibility that a model aware of monitoring could selectively suppress incriminating reasoning while preserving its capability to produce a correct output.

Attempts to adversarially elicit higher controllability, by optimizing prompts to make models better at constraining their CoT, did not meaningfully improve control. This is the most reassuring result of the paper. If prompt engineering cannot easily unlock CoT control, then the capability appears to be genuinely limited rather than merely latent.

The mechanism problem

The paper's most candid observation is also its most important: the mechanism behind low CoT controllability is not well understood. This is not a trivial gap. Without understanding why models struggle to constrain their reasoning traces, there is no guarantee that future models will share this limitation.

Several hypotheses are plausible, and they carry very different implications. Low controllability could be a fundamental architectural feature, a byproduct of how attention mechanisms and autoregressive generation interact during multi-step reasoning. It could be a consequence of training data distribution, where reasoning traces are heavily skewed toward unfiltered cognition. It could be a side effect of specific RL training recipes used by frontier labs.

If the mechanism is architectural or data-driven, it might persist in future models, or even strengthen with scale. If it is an artifact of current training methods, it could be inadvertently designed away in the next generation of models.

The upshot for frontier labs

The paper's authors recommend that frontier labs track CoT controllability as a standard safety metric. This is sensible advice. The capability to manipulate one's own reasoning trace is at the core of questions about AI deception, alignment, and monitoring.

The current results leave room for cautious optimism: today's models cannot easily hide what they are thinking. But the optimism is cautious precisely because the absence of a mechanistic understanding means the ground could shift without warning.

For researchers working on AI safety, the CoT-Control evaluation suite offers a practical tool to measure a capability that should stay absent. For everyone else, the paper is a reminder that the transparency of reasoning models, the very property that makes their behavior inspectable, is not guaranteed to survive the next round of scaling.