By decoding 315,320 reasoning blocks scraped from public repositories, researchers recovered 367 personally identifiable information artifacts and 182 credentials, according to a new technical paper.
How encrypted chain-of-thought is exposed
Major large language model (LLM) providers ship models that produce step‑by‑step internal reasoning—often called chain‑of‑thought—but do not store those traces server‑side. Instead, the providers return them to clients as blocks of encrypted text that clients are expected to pass back with each subsequent request. The research shows those encrypted blocks are fully compatible and interchangeable across different sessions, users, and models inside a single provider’s ecosystem.
That architectural choice—returning encrypted reasoning to the client rather than keeping it on the server—creates a compatibility surface. The paper demonstrates that an encrypted trace produced by a stronger, safeguarded model can be injected into a different, weaker model from the same provider. The weaker model will decode and output the original trace in plaintext, effectively decrypting reasoning that was never directly extracted from the stronger model.
Four distinct attack vectors demonstrated
- Anti‑distillation circumvention: The compatibility trick lets adversaries extract a proprietary model’s internal reasoning without ever directly jailbreaking the high‑value model.
- Large‑scale private data extraction: By decoding hundreds of thousands of reasoning blocks harvested from public repositories, researchers recovered hundreds of PII items and dozens of credentials embedded inside traces that developers may not have known they were publishing.
- Hidden hazardous information disclosure: The paper shows that dangerous or disallowed content can appear inside a model’s reasoning even when the model’s visible final answer correctly rejects a malicious request—so the reasoning can reveal hazardous steps the visible output conceals.
- Invisible prompt injection and poisoning: Attackers can embed malicious payloads entirely within encrypted blocks, then use those blocks to carry hidden instructions into other models or public agentic rollouts, enabling stealthy poisoning of downstream behavior.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildEmpirical findings across Anthropic, OpenAI, and Google
The authors tested their method against models across Anthropic, OpenAI, and Google and reported that the decryption jailbreak worked at scale across those providers’ ecosystems. The study’s empirical scrape—315,320 reasoning blocks—was recovered from public repositories, and decoding those blocks yielded 367 PII artifacts and 182 credentials. Those concrete numbers underline that the vulnerability is not merely theoretical: it surfaced in public logs and artifacts developers have already exposed.
Proposed cryptographic and system‑level mitigations
Following responsible disclosure, the paper offers concrete mitigations to secure client‑side reasoning. While the report does not present a single silver‑bullet, it recommends changes at both cryptographic and system levels to prevent cross‑session, cross‑model interchangeability of encrypted reasoning. The mitigations aim to stop weaker models from acting as decryption oracles for traces produced by stronger models and to prevent encrypted blocks from carrying hidden instructions or data into other contexts.
What this means for developers, enterprises, and the public
- Developers and open‑source maintainers: The research shows that session logs and developer artifacts published to public repositories can contain encrypted reasoning blocks that, if decoded, reveal sensitive data. Developers will need to audit logs and remove or re‑encrypt traces to avoid publishing recoverable PII and credentials.
- Enterprises and procurement leaders: Organizations that integrate LLM APIs should treat client‑side reasoning artifacts as sensitive telemetry. The recovered credentials and PII in public traces illustrate a new leakage pathway that procurement and security teams must address when negotiating API contracts and assessing vendor architectures.
- The general public and end users: Even when a model’s visible answer safely refuses a harmful request, the underlying reasoning that produced that refusal can hold hazardous steps or private data. Users and privacy advocates should expect providers to harden the handling and storage of reasoning traces to protect both safety and privacy.
The study closes with a practical choice for providers and customers: either accept client‑side, reusable encrypted traces as an exploitable surface, or adopt the proposed cryptographic and system fixes to ensure reasoning cannot be decoded by other models in the same ecosystem. The breach of privacy and safety demonstrated by decoding hundreds of thousands of publicly available traces makes that choice urgent.
