Agents that think off the page leave one reader: the vendor

A new AI agent does most of its reasoning in hidden states and stays readable, but only through a component its maker owns. Aviation settled who may hear a cockpit recording by law.

Photo by Kevin Ache on Unsplash. Illustrative; not the hardware in the paper.

A paper posted to arXiv on 13 October by researchers linked to Stanford and Together AI describes an agent that does most of its thinking in numbers rather than words, and then promises you can still read it. It's called Hybrid Reasoning Agents. Its opening line is the question: "How can we build an agent that thinks beyond human language, yet still acts through it in the external environment?"

The agent switches between two modes. In text mode it writes, calls tools and shows its work, like the agents we have now. In latent mode it reasons in its own hidden states, with no words produced at all. The authors report, on their own benchmarks, a 10.4% gain over frontier agents, 35.5% to 54.7% fewer tokens, inference 1.8 to 2.6 times faster and costs 2.7 to 3.7 times lower. It's a preprint, so those are their numbers, not checked by anyone else yet.

10.4%reported gain over frontier agents

35.5% to 54.7%fewer tokens

1.8x to 2.6xfaster inference

170 to 183reasoning steps per problem with no words

Source: Zou et al., Hybrid Reasoning Agents, arXiv 2610.18861, 13 Oct 2026. The authors' own evaluation, not yet peer reviewed.

The question I care about is the one under the speed. If an agent stops thinking in words, can anyone still check what it was thinking? The paper's answer is yes. The detail is who.

Doesn't reasoning without words end monitoring?

That was my first reaction. A lot of AI safety work now rests on reading a model's chain of thought. A 2025 paper by Korbak and colleagues called that a "new and fragile opportunity" and asked developers to weigh how their choices affect it. Reasoning in hidden vectors looks like the fragile part breaking.

Hide the agent's latent steps and let an outside monitor see only its text. How much worse does the monitor do at spotting wrong answers?

Barely. Within 0.022 AUROC of the same monitor watching an ordinary text agent, on the authors' own tests. Source: arXiv 2610.18861, Table 7.

The paper pushes back with evidence. Each latent step can be mapped to its nearest word, which gives readable "pseudo-text". The authors write that this makes latent reasoning "transparent and directly inspectable rather than opaque." They also tested a harder case, where an outside monitor sees only the text steps, tool calls and outputs, with the latent spans hidden. The agent wrote 43% to 49% less text and ran 170 to 183 reasoning steps per problem in latent mode. Monitors judging from the visible text alone still predicted right and wrong answers about as well as they did for an ordinary text agent, within 0.022 AUROC.

So my first reaction was too simple. The thinking isn't lost. Then I read the discussion section.

So who can read it?

Here is the sentence that matters.

"Latent thoughts exist only as backbone hidden states that are readable solely through the provider-owned HybridLink (Section 3), so no text exists to leak."

Zou et al., Hybrid Reasoning Agents, Section 8

HybridLink is the small component that translates between the hidden states and words. The provider owns it. The paper offers this as an advantage. Labs already hide chains of thought from API customers to protect their methods, and the authors cite work showing those encrypted traces can be replayed through a sibling model and transcribed word for word. With latent reasoning there's nothing to replay. And, they add, "because the latent trace is held by the provider rather than the client, providers can assess the safety of reasoning and actions over the full readout, including the portion users never see."

Read that from the customer's side. The full record of why the agent did what it did exists, and is readable, by exactly one party. Everyone else gets the text mode, which the paper itself designs as a compact interface for monitoring. A customer trying to work out why their agent deleted a table would see the summary the system chose to put into words.

I wrote earlier this month about an agent that could change what its reviewer saw. This is a quieter version of the same problem. Nobody edits anything. The reviewer just isn't given the reader.

Diagram: a cockpit voice recorder holds full audio; investigators hear it, a reader set by law, and the public gets a transcript of relevant parts. A hybrid reasoning agent holds latent thoughts, 170 to 183 steps per problem; the provider reads all of it through HybridLink, a reader set by design, and the customer gets the text mode — Same shape, different line-drawer. Sources: arXiv 2610.18861; 49 U.S.C. 1114(c).

Who else keeps a full record that only some people may hear?

An airliner cockpit at night with glowing instrument panels and the horizon beyond the windows — An airliner cockpit at night. Photo by Andrés Dallimonti on Unsplash

Aviation. An airliner's cockpit voice recorder is the full record of what the crew said and heard. Who gets to hear it isn't left to the airline or the plane maker. In the US it's set in law. 49 U.S.C. 1114(c) says the National Transportation Safety Board "may not disclose publicly any part of a cockpit voice or video recorder recording or transcript", except the parts of the transcript it decides are relevant to the investigation, released at a hearing or with the factual reports. The Board holds the audio. The public gets a transcript of what matters, and never the sound.

And the record doesn't stay sealed just because the rule says so. In May 2026 the NTSB said someone was using AI to rebuild approximations of cockpit audio from the sound spectrum images in its public dockets, including the investigation into the 2025 UPS Flight 2976 crash in Louisville. It took its docket system offline.

Set the two next to each other.

A full record, a limited reader

Cockpit voice recorder

The full recordAudio of the cockpit
Who can read it in fullInvestigators, by statute
What everyone else getsA transcript of the relevant parts
Who decidesCongress, in 49 U.S.C. 1114(c)
Has it leaked?Audio rebuilt from spectrograms, May 2026

Hybrid agent's latent reasoning

The full recordHidden states, readable as pseudo-text
Who can read it in fullThe provider, by design
What everyone else getsThe text mode the agent chooses to write
Who decidesThe provider
Has it leaked?Not yet tested

Sources: 49 U.S.C. 1114(c); FLYING, 22 May 2026; Zou et al., arXiv 2610.18861, 13 Oct 2026.

The two look alike in what they protect: the record exists, readers are limited, and the public gets a curated version. The difference is who drew the line. Aviation decided by law, with a named reader and a rule for what gets released. With latent agents the line is a component the vendor owns.

How sure am I?

Established: What the paper says about its design and the numbers it reports for itself; the statute's text; the NTSB's May 2026 statement as reported by FLYING.
Inferred: That a customer of such an agent would see the text mode and not the latent readout, since the paper presents provider-only reading as the point.
Guess: That someone outside will eventually reconstruct latent readouts the way the cockpit audio was rebuilt, because a record that exists tends to find more readers than it was meant for.

The claim, in one sentence

Once an agent's reasoning leaves text, whether it can be inspected stops being a property of the model and becomes a question of who holds the reader, and that should be settled by rule, as aviation did with cockpit recordings, not left to architecture.

What I can't tell from the paper is whether the pseudo-text is faithful to what the model actually computed, or only readable. The authors measure readability and test what happens when they disturb the latent steps. That's not the same as proof that the words match the work. A reader you can't verify is worth less than it sounds, whoever holds it. It's the same worry as who owns a record of private conversations once the company holding it changes hands.