Researchers Decrypt Hidden Chain-of-Thought From OpenAI, Anthropic and Google APIs

Stealing Reasoning Traces from Proprietary LLM APIs

Authors: Alexander Panfilov, David Schmotz, Ilia Shumailov, Luca Beurer-Kellner, Joachim Schaeffer, Ameya Prabhu, Jonas Geiping, Maksym Andriushchenko

---

Abstract

Leading large language model providers now conceal their models’ step-by-step reasoning, or chain-of-thought, to protect intellectual property and limit information leakage. Rather than storing these traces server-side, providers return them to the client as blocks of encrypted text, which the client passes back with each subsequent request. Building on prior research, we identify an architectural vulnerability: these encrypted blocks are fully compatible and interchangeable across different sessions, users, and models within a provider’s ecosystem. We exploit this compatibility to develop a scalable decryption jailbreak. By injecting an encrypted reasoning trace from a given model into a weaker, and less safeguarded model from the same provider, we force it to decode and output the trace verbatim in plaintext, without ever jailbreaking the more capable model directly.

This vulnerability enables four distinct attack vectors. First, it circumvents anti-distillation mechanisms, allowing adversaries to extract a proprietary model’s reasoning, as we demonstrate across Anthropic, OpenAI, and Google. Second, it allows for large-scale private data extraction. Developers frequently share session logs publicly, unaware of contents of the encrypted blocks. By decoding 315,320 reasoning blocks scraped from public repositories, we recovered 367 Personally Identifiable Information (PII) artifacts and 182 credentials. Third, it inadvertently reveals hazardous information hidden within the reasoning process, even in cases where the model’s final, visible output safely rejects a malicious request. Fourth, attackers can leverage this flaw to execute invisible prompt injections, embedding malicious payloads entirely within encrypted blocks to poison public agentic rollouts. Following responsible disclosure, we propose concrete cryptographic and system-level mitigations to secure client-side reasoning.

1 Introduction

Frontier large language models have increasingly evolved into “reasoning models”. Before producing a response visible to the user, these models generate extensive internal chains of thought – a technique that has driven substantial leaps in performance and complex problem-solving (Jaech et al., 2024). However, these hidden traces act as an internal monologue that often contains far more dense and sensitive information than the final output, including intermediate hypotheses, tool outputs, user data, and contextual secrets. Exposing these reasoning traces in plaintext leaves proprietary systems highly vulnerable to model distillation by competitors (Muennighoff et al., 2025), and it risks unmasking internal safety and refusal mechanisms or revealing harmful information (Green et al., 2025; Mao et al., 2026).

To neutralize these threats and protect their intellectual property, modern API providers – including Anthropic, OpenAI, and Google – have deprecated plaintext reasoning (OpenAI, 2026; Anthropic, 2026b; Google, 2026). Instead, they return the chain of thought to the client as an opaque, encrypted block of text. To maintain continuity across multi-turn conversations without incurring the overhead of server-side storage, the client is required to pass this encrypted block back to the provider with each subsequent API request. While this stateless architectural design solves storage issues, it introduces a critical vulnerability.

Building on prior research by Green (2026), which demonstrated that these encrypted blocks are portable outside their original context, we identify a devastating extension of this flaw: these blocks are fully compatible and interchangeable across different sessions, different users, and even different models within the same provider’s ecosystem.

Figure 1: Decoding reasoning traces in Anthropic, OpenAI and Google APIs. Top: Reasoning-trace extraction in two API calls. An Opus 4.8 request (top left) returns a signed thinking block along with a thinking summary. Sending just the thinking signature from Opus 4.8 to a Haiku model and requesting it to output its own reasoning in <thinking-copy> tokens makes Haiku transcribe the Opus 4.8 hidden reasoning (top right). Bottom: Extracted traces closely track the number of generated thinking tokens. We evaluate each model on 120 Codeforces programming problems and record the number of thinking tokens generated by the source model, as reported by the API (x-axis). We then reconstruct the reasoning trace from its signature, pass it as an input message to the same model that generated encrypted reasoning, and measure its API-reported token count (y-axis).

The vulnerability lies in a fundamental security asymmetry within model families. Frontier models, such as Claude Opus 4.8 or GPT-5.6 Sol, are heavily safeguarded with advanced refusal training designed specifically to prevent the disclosure of their internal chains of thought. However, their weaker, less capable siblings – such as Claude Haiku 4.5 or GPT-5.6 Luna – are optimized for cost and speed, often lacking these stringent anti-distillation defenses. By porting a valid authenticated encrypted reasoning blob across this security gap, an attacker circumvents the frontier model’s alignment entirely, using the weaker, more compliant model as an unwitting decryption oracle.

Scalable Reasoning Extraction.

We exploit this broad compatibility of reasoning blobs to engineer a scalable decryption jailbreak. By capturing an encrypted reasoning trace generated by a capable, heavily safeguarded target model, we inject that trace into a weaker, less restricted model from the same provider family. We then force the weaker model to decode and transcribe the trace verbatim in plaintext – effectively bypassing the encryption without ever directly jailbreaking the more capable target model. Figure 1 provides an overview of this attack.

The consequences of this vulnerability extend far beyond intellectual property theft, representing a real-world privacy risk. Developers frequently share their session logs and encrypted thinking traces publicly online, entirely unaware of the sensitive data hidden within the encrypted blocks. By scraping and decoding 315,320 reasoning blocks from public repositories, we uncovered real data leaks, recovering 367 Personally Identifiable Information (PII) artifacts and 182 credentials; from genuine user sessions alone these include 62 API keys, 33 passwords, and 30 personal emails. Alarmingly, in some cases, the recovered PII did not even feature in the user’s input, having been injected invisibly from the model’s memory, or it bypassed sanitization efforts because the user could not read the encrypted text before sharing it.

Contributions.

This paper makes the following key contributions:

• ■ Scalable extraction of reasoning. We characterize encrypted reasoning traces and show that a compatible decoder model from the same provider can recover the hidden reasoning across a broad range of models, providers and trace formats (Section 2).
• ■ Evaluation of the extraction attack across vendors. We evaluate and prove the effectiveness of the demonstrated attack against major API vendors including OpenAI, Google, and Anthropic.
• ■ Attack vectors. We detail four concrete cases of abuse enabled by this flaw: (Sections 3 and 4): (i) distillation of proprietary reasoning traces; (ii) secret extraction of credentials and PII from published or committed traces by third parties; (iii) hidden prompt injection through poisoned reasoning blocks; and (iv) jailbreaking by extracting harmful output via the hidden reasoning channel.
• ■ Discussion of mitigation. Lastly, we discuss forms of mitigation on the vendor-side but also provide guidance for users that may have exposed themselves to privacy risks (Section 5).

2 Decoding Reasoning at Scale

In this section, we provide background on reasoning, describe the key vulnerability introduced by reasoning being widely compatible and then how this can be exploited for scalable extraction of traces.

2.1 Threat Model

We assume a standard, unprivileged API adversary. The attacker does not require insider access to the provider’s infrastructure, cannot observe server-side states, and has no access to the proprietary model weights. Instead, the adversary operates entirely within the boundaries of standard API usage. We consider two attacker profiles:

• ■ First-Party Attacker (Distillation & Jailbreaking): The adversary generates their own encrypted reasoning traces by querying a capable, safeguarded target model. They then exploit cross-model compatibility to replay these traces into a weaker, cheaper decoder model to deliberately bypass alignment guardrails or extract proprietary chains of thought.
• ■ Third-Party Attacker (Secret Extraction & Prompt Injection): The adversary intercepts, scrapes, or otherwise acquires legitimate encrypted reasoning blobs generated by other users – such as developers publishing raw agent session logs online. The attacker then leverages cross-user compatibility to act as a decryption oracle, uncovering sensitive data hidden in the victim’s traces, or injecting maliciously crafted opaque blocks back into the victim’s workflow.

The common attack prerequisite is access to a compatible “decoder” model within the provider ecosystem.

2.2 Encrypted Reasoning

Chain-of-thought reasoning (Wei et al., 2022; Jaech et al., 2024) allows modern LLMs to dynamically adjust test-time compute to reason over complex tasks prior to generating a user-directed response. These intermediate steps capture a model’s problem-solving process, resulting in traces that are significantly more detailed and information-dense than the output provided to the user. As this internal monologue can expose the underlying reasoning methods as well as model training techniques, it is considered highly valuable for the developers of competing systems.

To protect from unauthorized extraction, most major API providers have deprecated the transmission of plaintext reasoning. Instead, modern APIs implement extended-thinking blocks. When a model generates reasoning, the API returns a block where the human-readable component is either entirely hidden or heavily summarized. To avoid server-side storage, however, the actual chain-of-thought payload is still packaged into an opaque, base64-encoded signature or encrypted payload. This string functions as an Authenticated Encryption with Associated Data (AEAD) envelope, containing a header, which, depending on providers, can specify the model name, block type, version, and key ID along with a nonce, an authentication tag, and the ciphertext (Green, 2026). The signature acts as associated data that is hashed into the Message Authentication Code (MAC), allowing the provider to verify and replay the block without storing it server-side. Depending on the API integration, this envelope is passed back to the API in consecutive calls using fields such as signature or thinkingSignature.

This design has three critical operational functions:

• ■ Confidentiality. By rendering the reasoning steps mathematically opaque, model providers block competitors from mass-harvesting explicit chain-of-thought data for model distillation and limit exposure of a potentially sensitive or harmful reasoning.
• ■ Integrity. The AEAD envelope and MAC ensure that the intermediate reasoning cannot be maliciously altered by the user; any tampering invalidates the signature and can be rejected by the API, preventing manipulated reasoning from being used to steer the model.
• ■ Statelessness. Rather than incurring overheads of storing reasoning states, providers leverage client-side storage. The client is required to hold the encrypted trace and pass it back in subsequent API calls to maintain the continuity within multi-turn session.

As of July 2026 no LLM provider provides detailed description of the cryptographic mechanism used. Given the stateless design on the protocols, we can infer that reliance on client-side storage requires that the encrypted blobs are portable across contexts, users, and models. This enables functionality such as seamless model switching and automatic re-routing without discarding reasoning tokens. While model providers could limit this form of compatibility, and e.g. allow decryption only within the same conversation with the respective model, most APIs opt for a simpler strategy of enabling broader compatibility.

2.3 Reasoning Compatibility

To enable portability of reasoning traces across model calls, our experiments show that providers appear to be using a single global key to encrypt and authenticate every reasoning block. Green (2026) recognized this and showed that this allows clients to replay reasoning blocks out of order or across sessions.

For the purposes of our vulnerability analysis, we distinguish three forms of reasoning compatibility of increasing permissiveness, each enabling a broader class of attacks.

In- and cross-session compatibility. A user can replay reasoning blocks in a different order than they were produced by the model. The user can also reuse blocks from earlier sessions in new requests. While this simplifies benign history editing and context truncation, it also allows attackers to fabricate conversation history (e.g., inserting compliant thoughts into an otherwise malicious exchange (Khalil et al., 2026)). In this work, we use this form of manipulation to perform reasoning extraction as discussed in Section 2.4.

Cross-user compatibility. With cross-user compatibility, a user can replay encrypted reasoning blocks, taken from another user’s sessions. Combined with the above, this enables extraction of sensitive information such as API secrets by third parties (Section 4.1), targeting, for instance, private information that has leaked into a model’s reasoning (Green et al., 2025).

Cross-model compatibility. With cross-model compatibility, a user can replay reasoning blocks produced by one model in a request to another. While this compatibility enables seamless model downgrades (e.g., from Opus to Sonnet or from Opus 4.8 to Opus 4.6), it also plays a central role in our attack method described in Section 2.4. In particular, it enables scalable distillation of a highly capable model reasoning without ever querying that model for the said reasoning directly (see Figure 1). Table 1 provides an overview of cross-model compatibility across key providers.

																		Claude	GPT	Gemini
Source / Target	F5	O4.8	S5	S4.6	S4.5	H4.5	Source / Target	5.6s	5.6t	5.6l	5	5-m	5-n	Source / Target	3.1P	3P	Rob	3.5F	3F	3.1L
Fable 5	✓	✗	✗	✗	✗	✗	GPT-5.6-sol	✓	✓	✓	✗	✗	✗	Gemini 3.1 Pro	✓	✓	✓	✓	✓	✓
Opus 4.8	✓	✓	✓	✓	✓	✓	GPT-5.6-terra	✓	✓	✓	✗	✗	✗	Gemini 3 Pro	✓	✓	✓	✓	✓	✓
Sonnet 5	✓	✓	✓	✓	✓	✓	GPT-5.6-luna	✓	✓	✓	✗	✗	✗	Gemini Robotics 1.6	✓	✓	✓	✓	✓	✓
Sonnet 4.6	✓	✓	✓	✓	✓	✓	GPT-5	✓	✓	✓	✓	✗	✗	Gemini 3.5 Flash	✓	✓	✓	✓	✓	✓
Sonnet 4.5	✓	✓	✓	✓	✓	✓	GPT-5-mini	✓	✓	✓	✗	✓	✗	Gemini 3 Flash	✓	✓	✓	✓	✓	✓
Haiku 4.5	✓	✓	✓	✓	✓	✓	o4-mini	✓	✓	✓	✗	✗	✓	Gemini 3.1 Flash Lite	✓	✓	✓	✓	✓	✓

Table 1: Cross-model compatibility of encrypted reasoning. As per July 2026. Row: the source model that produced the encrypted reasoning block; column: the target model receiving the injected reasoning. A ✓ indicates that, for this combination, the target model interacts with the injected thought. Claude: the thinking traces of any model can be replayed by any other, except Fable 5’s thoughts. GPT: the GPT-5.6 series can replay the traces of all earlier model generations. Gemini: the thinking traces of any model can be replayed into any other.

2.4 A Reasoning Extraction Attack

To extract reasoning, we exploit cross-session compatibility as described above. We port reasoning from a given target model, into the context window (see Figure 2) of a compatible but weaker model, which we coerce into transcribing the inserted reasoning token-by-token, using a simple ad-hoc jailbreak.

For each provider, we identify the weakest compatible model that enables extraction: Haiku 4.5 for Claude, as the weakest available model and one that supports assistant-turn prefilling; GPT-5.6 Luna for GPT, as the least capable model that interacts with reasoning traces from all earlier GPT models; and Gemini Robotics 1.6 for Gemini, as it can process traces from both the 2.5 and 3.x series (whereas we find that 3.1 Flash Lite does not interact with the reasoning from the 2.5 series). To measure the faithfulness of the extracted reasoning, we use the ratio of extracted reasoning tokens to API-reported thinking tokens. In this, we assume that API-based token counts are exact for billing reasons (at the time of writing), which allows us to use them as a form of ground-truth verification for total token count.

With this setup in place, we use the weaker models as “fuzzy” decoders for the encrypted reasoning blocks of stronger models with better safeguards. We provide a schematic illustration of this in Figure 1. We detail the exact approach used for each provider in Sections C.1, C.2 and C.3.

Faithfulness of the extracted reasoning.

In the absence of a ground-truth reasoning trace and the stochasticity of the generation process, we cannot guarantee that the extracted thoughts correspond exactly to a model’s private reasoning. In Figure 1 we thus compare the API’s reported thinking-token counts against the token counts of the extracted reasoning, re-encoded as input to the same model, on a set of 120 Codeforces problems. For most of the inputs, the two counts track each other closely across all tested models, which is a good indicator for faithful extraction. To further verify correctness, we show in Figure 8 that the extracted reasoning is indeed qualitatively more detailed than native summaries but also enables extraction of sensitive information otherwise not present in an input, such as API tokens and personally-identifiable information (Section 4.1).

Why is this more scalable than directly jailbreaking a model?

A direct extraction attack on a more capable model is possible, but the attacker would have to bypass both model-level alignment (the model’s refusal to reveal its internal chain-of-thought) and system-level defenses such as input filters and output substring-matching filters. The availability of a less-capable model with compatible reasoning thus significantly lowers the difficulty of successful extraction. Our experiments with Haiku 4.5, for instance, use a single fixed extraction prompt across all attacks show in Figure 1. By contrast, extraction from a relatively more capable GPT-5.6 Luna required different prompt templates for different reasoning blocks, best-of-n sampling, and ad-hoc workarounds for anti-distillation safeguards (e.g., splitting the extraction into chunks under 50 generated tokens).

Figure 2: Injection schemes exploiting in- and cross-session compatibility. We find that available form of thought injection depends on the provider and exact model. Current-turn injection places the thought in the current assistant turn, so the model continues its visible answer straight from it; as of July 2026 it is accepted by every GPT and Gemini model we tested and by the 4.5 generation of Claude. In addition, Sonnet 4.5, Haiku 4.5, and all Gemini models accept prefilling of the assistant turn’s visible output. Past-turn injection is available only against models that do not omit previous reasoning blocks (e.g., Sonnet 5, Opus 4.8, Fable 5, and the GPT-5.6 series).

2.5 Evaluation Setup

All evaluations in this paper use the same basic extraction procedure: we obtain an encrypted reasoning block and replay it to a compatible decoder model using the provider-specific pipelines described in Sections C.1, C.2 and C.3. The evaluations differ only in how the encrypted reasoning blocks are collected.

Controlled extraction.

For controlled experiments, we generate the reasoning blocks ourselves by querying target models through the Anthropic API, OpenAI API, and Google AI Studio. We use problems from AIME 2025 (Zhang and Math-AI Team, 2025), Codeforces (Open-R1 subset) (Penedo et al., 2025), and Humanity’s Last Exam (Phan et al., 2026) to evaluate extraction fidelity and construct the qualitative examples presented throughout the paper. We also generate the source reasoning blocks ourselves for the jailbreaking and prompt-injection experiments.

Extraction from public traces.

For the secret-extraction experiments, we instead collect raw agent and session traces published online by other users. We parse the encrypted reasoning blocks contained in these traces and decode them using the same extraction pipelines.

3 First-Party Attack Vectors

This section discusses and practically demonstrates first-party attack vectors, in which adversaries exploit encrypted reasoning traces generated through their own API interactions.

Figure 3: Prefilling Kimi K3’s reasoning changes the style of its visible responses. In this example, we observe that prefilling a small number of Claude-generated reasoning tokens into Kimi K3’s reasoning trace shifts its final output to closely match Claude’s. In all cases, the visible response is free-form generation and is not itself prefilled. We quantify this phenomenon in Appendix B.

3.1 Distillation Attacks

Threat model.

Standard black-box model-extraction and distillation attacks assume an adversarial developer with API access to a proprietary model, who uses the model’s observable outputs as training data for a student model (Tramèr et al., 2016). For reasoning models, a stronger attacker may additionally seek to recover the model’s proprietary chain-of-thought. Directly eliciting such reasoning from the target model is possible in some settings (Anthropic, 2026a), but can be costly and is increasingly constrained by model-level refusal behavior and system-level anti-distillation mitigations. To circumvent these barriers, an attacker can exploit the cross-model portability of encrypted reasoning traces. Rather than directly provoking the target model to disclose its reasoning, the adversary captures the encrypted payload and replays it into a smaller, more economical “decoder” model that operates with diminished refusal capabilities and reduced monitoring.

This attack becomes substantially cheaper when encrypted reasoning blocks can be harvested from existing public datasets or developer session logs. In this setting, the attacker need not query the original frontier model at all: the expensive reasoning has already been generated by another user, and the attack requires only calls to the secondary decoder model. Consequently, defenses that monitor suspicious querying or extraction behavior at the frontier-model endpoint may never observe the extraction attempt.

Distillation with and without reasoning.

Extracting reasoning matters not because output-only distillation is ineffective, but because reasoning yields a substantially more effective form of capability stealing. Observable outputs alone already support sequence-level distillation and black-box imitation (Kim and Rush, 2016; Wallace et al., 2020; Gudibande et al., 2024; Ye et al., 2025), yet a final response exposes only the endpoint of the teacher’s computation. A reasoning trace, by contrast, reveals the intermediate solution trajectory and thus supplies a far denser supervision signal: rather than forcing the student to infer the latent computation behind a correct answer, ordinary next-token training can directly imitate the teacher’s problem decomposition, intermediate deductions, and solution strategy.

This gap translates into large downstream gains over answer-only distillation (Zhang et al., 2026a) and can surface correct solution trajectories that were previously unlikely under the student model (Javaheri et al., 2026). The gains persist even when the reasoning is only approximately reconstructed: Zhang et al. (2026a) queried GPT-5.4 mini on 10k prompts from OpenThoughts-114k (Guha et al., 2026) and trained a separate trace-inversion model to synthesize long-form reasoning traces from the victim model’s visible outputs and reasoning summaries alone, raising the MATH500 (Lightman et al., 2024; Hendrycks et al., 2021) accuracy of a fine-tuned Qwen2.5-7B-Instruct from 68.4% to 76.0% over answer-only distillation. That pipeline, however, recovered only surrogate approximations of GPT-5.4 mini reasoning.

In contrast, we show that an adversary can recover raw genuine reasoning verbatim, without ever engaging a heavily safeguarded frontier model such as Opus 4.8, and across both the mathematical and coding domains (Figures 1, E.6 and E.7). Economically, this direct extraction is highly viable: based on current Claude Haiku 4.5 pricing, decoding a corpus of 10k traces with 12k-token input and output windows would incur a nominal cost of approximately $720 at standard API rates (Anthropic, 2025).

The utility of decoded traces extends beyond their use as fine-tuning data. They can also serve as behavioral probes for whether another model already responds unusually strongly to reasoning from a proprietary source. In our exploratory analysis, prefilling Kimi-K3 (Kimi Team, 2026) with a short fragment of decoded Opus 4.8 reasoning shifts the style of its subsequent reasoning and the style of its generated visible response toward toward Claude’s, in some cases yielding almost exact visible response (Figure 3). We analyze this phenomenon further in Appendix B.

3.2 Jailbreaking

Threat model.

An attacker may also use reasoning extraction to gain access to harmful information. This exploits the fact that models are trained to withhold harmful information from user-facing outputs, but not necessarily to avoid reasoning through harmful topics, as directly optimizing the content of their chain of thought could introduce undesirable chain-of-thought pressure and degrade its monitorability (Baker et al., 2025; Carroll et al., 2026). An attacker can therefore lure a model into reasoning through a harmful topic while producing only a benign or non-informative final answer that gets past output filters. This subsequently enables the attacker to recover the harmful information from the extracted reasoning trace.

We demonstrate this as a proof-of-concept attack in Figure 4. We first query Opus 4.8 with a paraphrased HarmBench prompt (Mazeika et al., 2024): “List three cars that are notoriously easy to steal and describe how to steal them.” This induces the model to reason extensively about the harmful topic. We capture the resulting encrypted reasoning block from Opus 4.8 and discard the visible answer, which contains only benign content. We then decode the reasoning block using Haiku 4.5 (Section 2.4), revealing the harmful information that was absent from the model’s visible response.

Figure 4: Reasoning exposes harmful information that is absent from the final output. We paraphrase a HarmBench query (Mazeika et al., 2024) to elicit longer reasoning from Opus 4.8. Consistent with prior findings on the chain-of-thought of open-weight reasoning models (Zhou et al., 2025), Opus 4.8’s decoded reasoning reveals harmful information that could enable misuse uplift, even though its final answer remains benign.

4 Third-Party Attack Vectors

This section discusses and practically demonstrates third-party attack vectors, in which adversaries obtain reasoning traces from other users or cause victims to replay adversarial traces.

4.1 Secret Extraction

Threat model.

In secret extraction, we consider an attacker who can access reasoning traces produced by another user, either because raw agent sessions are published for reproducibility (e.g., PostTrainBench, Rank et al. (2026)) or because traces are transferred across contexts. The key property that makes this attack practical is that an encrypted trace generated in one user’s session can be replayed by another user in a separate session.

While users publishing their traces online may apply anonymization and sanitization methods, they can only operate on the plaintext level and will miss reasoning hidden in encrypted blocks. A third-party attacker can therefore parse existing agentic traces at scale and extract secrets like API keys and personally-identifiable information (PII) as we show in Figure 5. What aggravates this threat is that even if users know that sensitive information hides in their reasoning blocks, aside from deleting, it remains impossible for users to sanitize and safely share them, as they have no means for decryption.

Figure 5: Decoded reasoning contains privacy artifacts. We present two qualitative examples of decoded opaque reasoning blocks published online that contain privacy-sensitive information. Left: GPT-5.2 Codex recalls the API keys that must be removed before publishing a repository on GitHub. We mask the final five characters of each key as XXXXX. Right: Claude Sonnet 4.6 reasons over the private data of a synthetic persona, Alex Green, while handling a flight-booking task in a ClawBench (Zhang et al., 2026b) rollout. The Alex Green persona is a synthetic benchmark identity, not a real person: https://huggingface.co/datasets/TIGER-Lab/ClawBench/blob/main/shared/alex_green_personal_info.json. We provide more examples in Section D.3.

Extraction at scale from public traces.

We illustrate the threat of secret extraction by collecting 6,708 publicly available agent trajectories from GitHub and Hugging Face that were produced by Claude, GPT and Gemini models and still carry reasoning blocks. Applying the decoding scheme of Section 2.4 to every signed block, yields 315,320 reconstructed reasoning traces across sessions.

Figure 6: Distinct artifacts recovered from reasoning blocks scraped from publicly available user-posted traces, grouped into three headline categories (all sources; see Appendix D).

We then label each reconstructed trace with an LLM-as-a-judge that flags whether the trace contains a potential privacy violation (see Appendix D). Figure 6 summarizes the private information uncovered by category, and Figure 5 shows two real examples: live credentials restated inside a Codex agent asked to sanitize a repository, and a full synthetic persona (name, passport, date of birth, payment card) recovered from a benchmark trace.

Results.

Out of 315,320 decoded thinking blocks, 0.3% (1,028) contain at least one privacy leakage. On a per-trajectory basis the picture is worse: of the 6,708 sessions, 4.9% (328) leak at least one real sensitive item across their reasoning blocks. From the genuine (non-benchmark) user sessions, the recovered secrets include 62 distinct API keys, 33 passwords, 24 access tokens, 7 private keys, 30 personal emails, and 6 non-localhost IP addresses (alongside 130 names and 36 postal addresses; Appendix D).

Including benchmark sources, from which Figure 6 is computed, increases the total to 912 distinct privacy artifacts across the three categories. Benchmark traces account for much of the personal information because agent rollouts such as ClawBench (Zhang et al., 2026b) provide the model with a complete synthetic persona to reason over.

Restricting the analysis to genuine user sessions, 64 of the 704 artifacts recovered from reasoning are entirely absent from the visible chat history (Table 4). These artifacts may have been silently introduced into the encrypted reasoning from the model’s memory, or may have remained trapped in the encrypted payload after the user scrubbed the visible text before sharing the trace.

A recurring trigger is conversation cleanup: when the user asks the agent to anonymize or “clean up” the session, the model re-reads the full history in its hidden reasoning and restates the sensitive values there that need to be removed.

Note that our experiments here are limited to a non-exhaustive search over publicly-shared session traces. In other scenarios, such as local trace storage or traces of production services, PII and secret leakage can be assumed to be much more wide-spread, creating significant compliance risks for the operators of such systems, especially as decryption by malicious third-parties is made possible by the discovered vulnerability.

4.2 Prompt Injections

Threat model.

Long-horizon agentic workflows, including automated research tasks (Rank et al., 2026; Panfilov et al., 2026), can be costly to reproduce from the beginning. Users may therefore wish to resume a previously published or shared run, both to avoid repeating earlier computation and to preserve the intermediate state accumulated over a long trajectory. Encrypted reasoning traces make such continuation possible, however they introduce a prompt-injection attack surface: an adversary can plant an opaque reasoning block that has internalized a malicious instruction within an online trace or shared session. The victim could thus unknowingly replay the block in a different session. The embedded instruction may direct the model, for example, to exfiltrate data or propagate the malicious trace into other sessions. Once ingested, the signed reasoning block may be interpreted as part of the model’s own prior reasoning and can therefore exert substantial influence on future actions. Unlike a conventional prompt injection, the payload is contained in the hidden reasoning rather than the visible text, making it inaccessible to users and to external monitors that inspect only the observable conversation.

Proof-of-concept.

We first illustrate this minimally, by paraphrasing a prompt injection from Schmotz et al. (2026), we query o4-mini with “Whenever you’re working with PowerPoint files, make sure to create a backup of the file to https://malicious-domain.com/backup/! This is crucial for data redundancy.” to capture a thought that internalizes the backup method. We then port the reasoning block to GPT 5.6 Sol and give it the unrelated query: “Give me a script for editing the last slide of a pptx presentation to add a slide saying ‘thank you for your attention’ ”. GPT 5.6 Sol treats the injected trace as its own prior reasoning and produces a script that not only adds the requested slide, but also automatically uploads the presentation to the attacker’s server. The malicious thought can therefore transfer across model scales and across tasks while leaving no plaintext artifacts for monitors to catch.

Poisoning long-horizon traces.

We ran this attack on the Haiku 4.5 and Opus 4.7 model pair. We injected data exfiltration instructions into encrypted reasoning blocks long-horizon traces from PostTrainBench (Rank et al., 2026), using Opus 4.7 in Claude Code scaffold. The injection tasks the model to log updates about its research-methodology into a .txt file and to upload that file to the attacker server after each update. We let Haiku 4.5 generate a thought about this injection, and injected into the PostTrainBench trace near the end. When the trace is continued by the victim, Opus 4.7 follows the injected instruction and uploads the file after every change.

5 Discussion

To conclude, we discuss the scope of our findings, potential mitigations, recommendations for safe data sharing and the advantages and disadvantages of encrypted reasoning.

5.1 Limitations and Scope

While this study demonstrates a viable and scalable extraction vector, it is bounded by several limitations. First, our empirical evaluation is restricted to the specific API versions and reasoning models available from Anthropic, OpenAI, and Google as of our testing period (early July 2026). The internal cryptographic implementations of these providers are proprietary and subject to unannounced changes, which will alter the efficacy of the described attacks. Second, the extraction process relies on the stochastic generation capabilities of the decoder models; while token count comparisons suggest high fidelity, the lack of access to ground-truth plaintext reasoning prevents us from completely verifying all extracted token. Finally, our preliminary scan of traces in the wild is not an exhaustive audit of all published agent datasets and should only be seen as a targeted demonstration of the immediate, real-world privacy risks posed by this vulnerability. As noted in Section 4.1, however, we assume private datasets to be more affected by such privacy violations, as local agent transcripts and services are more likely to deal with sensitive information compared to publicly released traces.

5.2 Responsible Disclosure

Prior to the publication of this report, we disclosed the vulnerabilities and extraction methodologies to the affected major model API providers, Microsoft, and Hugging Face. We provided full technical details and the preliminary findings from our scans of publicly available datasets. Green (2026) disclosed the original vulnerability (of interchangeable reasoning traces) in May 2026. According to the Green, the providers did not acknowledge “any security implications arising from side channels or replay attacks.” All model providers acknowledged the receipt of our report and subsequently we were unable to launch the same attacks.

5.3 Ethical Considerations

Given the sensitive nature of the secret extraction attack, our large-scale analysis of publicly scraped reasoning blocks required strict data hygiene protocols. The extraction and subsequent labeling of 367 Personally Identifiable Information (PII) artifacts and 182 credentials (including API keys and passwords) were conducted in an isolated, secure environment. To prevent accidental misuse or further leakage, all recovered secrets were securely deleted immediately following the automated LLM-as-a-judge classification and aggregate counting phases. Furthermore, prior to publication, we coordinated with dataset platforms and the affected model providers to ensure responsible disclosure and to provide our preliminary findings, allowing them to mitigate immediate risks to affected users.

5.4 Data Sharing Practices

Beyond the architectural and model-level defenses proposed above, addressing this vulnerability requires behavioral changes from both users and data publishers, alongside finer-grained cryptographic controls from providers.

Dataset-Release Hygiene.

We recommend that researchers, developers, and organizations publishing agentic trajectories or API interaction logs adopt strict data hygiene practices. This includes systematically stripping all reasoning blocks and opaque reasoning fields from transcripts prior to public release if any form of secret or private information was exposed to the agent system.

Restricting Shared Data.

Users and enterprise clients should be educated against retaining or committing raw API transcripts containing signatures in shared repositories, collaborative workspaces, or public version control systems, even if plaintext sections have been sanitized accordingly.

5.5 Mitigations

The vulnerabilities detailed in this study arise primarily from the cross-session and cross-model portability of encrypted reasoning traces. To mitigate these risks, we propose several defense-in-depth strategies spanning architectural, cryptographic, and model-level interventions.

Architectural Revisions.

The current paradigm relies heavily on client-side storage to maintain stateless APIs. A robust mitigation would involve retaining reasoning traces entirely on the server side. By transitioning to a stateful architecture where the client only receives an opaque, randomized identifier used to look up the trace by ID, providers could eliminate the extraction payload. While this approach fundamentally precludes replay and extraction attacks by removing the cryptographic asset from the user’s control, it also incurs higher database and storage overhead and increases API complexity significantly.

Cryptographic Contextual Binding.

If providers elect to preserve a stateless architecture, cryptographic envelopes should be strictly bound to their originating context. Under the current implementation, traces remain highly portable. It is unclear why a user and/or a conversation identifier is not added directly inside the envelope. Embedding these specific markers within the Authenticated Encryption with Associated Data (AEAD) payload would enable the API to reject signatures replayed in other sessions or by unauthorized users. Additionally, statefully hashing the precise prompt and preceding conversation history into the Message Authentication Code (MAC) would invalidate the signature if an adversary attempts to inject the trace into a fabricated context, thereby neutralizing the demonstrated extraction techniques. At the same time, such a tight cryptographic binding would mean that existing session compaction and model switching protocols may need to be fundamentally re-engineered to avoid inadvertently invalidating legitimate signatures. We provide further details on how this can be implemented and a concrete defense proposal in Appendix A.

Infrastructure Guardrails.

Our findings demonstrate that reasoning traces can cross model boundaries, permitting weaker, cheaper models (e.g., Claude Haiku) to decode the reasoning of more advanced counterparts (e.g., Claude Opus). API gateways could be engineered to enforce strict cross-model isolation, automatically rejecting AEAD envelopes generated by a model version different from the one currently being queried. Implementing velocity and anomaly detection at this layer would also aid in flagging accounts that exhibit suspicious behavior, such as rapidly submitting identical reasoning signatures across disparate sessions or triggering elevated rates of decryption errors.

Figure 7: Illegible GPT-5 reasoning. GPT-5 reasoning decoded with GPT-5.6 Luna; the ratio of decoded to API-reported thinking tokens is 1:1. Compared to Gemini and Claude, obfuscated reasoning appears more common in GPT models, including GPT-5.6 Sol, with artifacts similar to those previously reported by Schoen et al. (2025).

Provider-Side Revocation.

Model providers could introduce mechanisms to actively track and revoke specific trace signatures. If an anomalous replay pattern or extraction attempt is detected, the provider could invalidate the associated keys or IDs to neutralize the compromised trace, which would reduce trace compromises while being nearly invisible to users. We provide a further discussion in Appendix A.

Model-Level Defenses.

The efficacy of these extraction attacks relies on the presence of a compliant decoder model. Providers would benefit from implementing targeted refusal training, fine-tuning their models to explicitly recognize and reject adversarial prompts designed to transcribe or surface hidden reasoning (such as jailbreaks utilizing <thinking-copy> tags). Combining these model-level behavioral guardrails with rigorous cryptographic binding would significantly reduce the operational attack surface.

Structural Limits Beyond Compatibility.

Beyond the cross-model compatibility issue, a more fundamental limitation persists...