Across 6,708 public agent trajectories, the research team decoded 315,320 "thinking" blocks — and, after excluding benchmark sources, identified 704 distinct privacy artifacts including 62 API keys, 33 passwords, 24 access tokens and seven private keys.
How encrypted reasoning objects were meant to work — and why they were useful
The paper Stealing Reasoning Traces from Proprietary LLM APIs describes a design used by multiple providers to preserve internal reasoning across API calls when applications manage conversation state manually or operate statelessly. OpenAI can return encrypted reasoning items that applications replay when they manage history by hand; Anthropic carries full reasoning in an encrypted signature; and Google uses encrypted "thought signatures." Those objects are intended to preserve reasoning state without exposing the underlying plaintext to clients.
The researchers emphasize that the encryption itself was not cracked and that the attack did not require obtaining an encryption key. The weakness arose because intact, opaque blocks were accepted and processed by the providers when replayed into another session or model.
Portability across sessions, users and models — and the "fuzzy" decoder
Testing showed these encrypted reasoning objects were portable across sessions, users and models within a provider family. That portability let a weaker, compatible model act as a "fuzzy" decoder: Claude Haiku 4.5 for Claude traces, GPT-5.6 Luna for GPT traces, and Gemini Robotics ER-1.6 for Gemini traces. The researchers prompted those decoders to transcribe the hidden reasoning produced by stronger models and recovered large volumes of internal traces.
Importantly, the cross-user attack did not yield arbitrary access to private chats. It required obtaining an encrypted reasoning block (for example, one published in an agent log) and having API access to a compatible model from the same provider.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleFour documented abuse paths and a prompt-injection proof of concept
The team demonstrated four abuse paths: (1) stealing proprietary reasoning for model distillation; (2) extracting private data from other users' published traces; (3) recovering harmful content concealed behind a safe visible answer; and (4) hiding prompt injections inside opaque reasoning blocks. In a proof-of-concept prompt-injection, the researchers crafted an opaque reasoning block that carried a malicious instruction and later replayed it into an unrelated task, causing the receiving model to add an attacker-directed upload action without the injected instruction appearing in visible text.
Scale of the recovery and the peculiar distribution of secrets
From 6,708 public agent trajectories the team decoded 315,320 thinking blocks. After removing benchmark traces, the group counted 704 distinct privacy artifacts from genuine user sessions. Of those, 64 artifacts appeared only in hidden reasoning and nowhere in the visible trace — meaning standard sanitization of readable conversation could leave secrets inside an opaque block.
The researchers caution they did not possess ground-truth plaintext for the proprietary reasoning, so they cannot guarantee every reconstructed trace is an exact copy; their fidelity checks relied on reasoning-token counts and qualitative comparisons, and extracted lengths generally tracked providers' reported thinking-token counts.
Vendor responses, mitigations and unresolved practical questions
The researchers disclosed their findings to Microsoft and Hugging Face and say the demonstrated attacks stopped working after mitigations; their reproducibility statement reports that the main extraction attack is no longer reproducible as of August 2026. No public acknowledgment of the flaw from OpenAI, Anthropic or Google has surfaced in the public record cited by the paper, and none of those vendors has publicly tied current documentation to the research.
Vendor documentation currently still references encrypted reasoning but shows changed handling: OpenAI continues to tell developers to replay encrypted reasoning items when manually managing stateless history; Google says its backend manages thought compatibility when a session switches models; and Anthropic now advises that thinking blocks are tied to the model that produced them and should be stripped when switching models because other models ignore them.
The paper also builds on earlier May research by Johns Hopkins cryptographer Matthew Green, who showed encrypted reasoning blocks could be replayed across sessions and accounts but did not develop a reliable secret-extraction technique. Green says he reported the replay behavior to OpenAI and Anthropic; in his account, OpenAI called the report unreproducible and Anthropic said it did not see security implications in the replay or side-channel behavior. The new work repurposes the replay behavior into a broader extraction method and documents privacy consequences at scale.
What this means for developers, model providers, and repository maintainers
- Developers and security teams: strip reasoning blocks and opaque reasoning fields from shared traces and avoid committing raw API transcripts even when the visible text has been sanitized, the researchers advise.
- Model providers and platform operators: the findings motivated mitigations that the authors say stopped the demonstrated attacks; providers have adjusted documentation and handling of encrypted reasoning items, per the public records cited in the paper.
- Repository maintainers and publishers of agent logs: published agent logs containing intact encrypted reasoning blocks can expose hidden content to compatible models and should be reviewed to remove opaque reasoning state before sharing.
The work leaves a narrow but consequential problem on the table: mitigations may stop fresh extraction attempts, but the researchers decoded hundreds of thousands of reasoning blocks already sitting in public repositories and the public record does not resolve whether those already-published blocks remain decodable. That question — whether past traces in public archives continue to expose secrets — is the clearest concrete next step spelled out by the facts the researchers published.
