Encrypted Reasoning Blocks Were Never Private. A Cheaper Sibling Model Reads Them Out Loud.

A paper posted August 10 decoded 315,320 reasoning blocks scraped from public agent logs and pulled out 62 API keys, 33 passwords, and 30 personal email addresses. The attack never touched the model that produced them.

Every reasoning model you call through an API hands you back a block you cannot read. Anthropic calls it a thinking signature. Google calls it a thought signature. OpenAI ships it as an encrypted reasoning item. You hand it back on the next request so the model can pick up its own train of thought, and in between you treat it as a checksum: opaque, boring, safe to log, safe to commit, safe to paste into a bug report.

Those blocks turn out to be interchangeable. Not across providers, but inside one. And every provider family has a cheap member with weaker refusal training.

That is the entire attack in Stealing Reasoning Traces from Proprietary LLM APIs, posted to arXiv on August 10 by Alexander Panfilov, David Schmotz, Ilia Shumailov, Luca Beurer-Kellner, Joachim Schaeffer, Ameya Prabhu, Jonas Geiping, and Maksym Andriushchenko. Take an encrypted reasoning block produced by a heavily guarded frontier model. Paste it into a request to a smaller, cheaper model from the same provider. Ask that model to print its own reasoning. It transcribes the frontier model's hidden thinking, verbatim, in plaintext.

The strong model's refusal training never enters the loop, because you never talk to the strong model.

The encryption was doing a different job than you thought

Here is the part worth sitting with. Providers did not build this to protect you. They built it to avoid holding state.

Storing every chain of thought server-side across every session is expensive and it makes the API stateful. Returning the trace to the client and asking the client to carry it is cheaper and cleaner. The encryption is there so the client cannot read the intellectual property it is being asked to babysit. It is a portability mechanism wearing a cryptographic costume. The paper lists three jobs for that envelope, confidentiality, integrity, and statelessness, and not one of them is keeping your own secrets out of a file you publish.

Nothing in that design ever promised the block was safe to publish. We all assumed it, because that is what ciphertext looks like.

The paper's compatibility table is where the assumption falls apart. Inside Anthropic, traces from one model replay into any other model tested, with Fable 5's thoughts the single exception. The GPT-5.6 series replays the traces of every earlier OpenAI generation the authors tried. Gemini is the loosest of the three: across the 3.x models tested, any model's thinking replays into any other. For Claude and OpenAI the researchers picked the weakest compatible decoder, Haiku 4.5 and GPT-5.6 Luna. For Google they took Gemini Robotics 1.6, the one model that accepts traces from both the 2.5 and 3.x series.

Cost matters here more than cleverness. The authors put the price of decoding 10,000 traces at roughly $720 at standard Haiku 4.5 rates, assuming 12k-token input and output windows. That is not a research grant. That is a weekend.

What was sitting in public logs

The second attack is the one that should send you to your own repositories.

The team collected 6,708 publicly available agent trajectories from GitHub and Hugging Face, produced by Claude, GPT, and Gemini models, that still carried their reasoning blocks. Decoding every signed block yielded 315,320 reconstructed traces.

Of those blocks, 0.3% (1,028) contained at least one privacy leak. That number sounds survivable until you flip the unit. Counted per session, 328 of the 6,708 trajectories (4.9%) leaked at least one real sensitive item somewhere in their reasoning. One in twenty published agent sessions.

From genuine user sessions alone, setting aside benchmark runs, the recovered secrets include 62 distinct API keys, 33 passwords, 24 access tokens, 7 private keys, 30 personal email addresses, and 6 non-localhost IP addresses, plus 130 names and 36 postal addresses. Totals across all sources reach 367 PII artifacts and 182 credentials.

The clearest illustration in the paper is a Codex agent, running a TerminalBench task, that had been asked to sanitize a repository. It did the job. It also restated the specific keys it was removing inside an encrypted block. Those particular credentials are benchmark fixtures rather than someone's live AWS account, so read the example for the mechanism and not the loss. The agent cleaned the room and left its notes about the safe on the table.

The fourth vector is getting the least attention of the four, and it is the one I would worry about next. Because the blocks are compatible across sessions and users, an attacker can write a payload that lives entirely inside an encrypted reasoning block and publish it in an agentic rollout. Anyone who replays that trajectory ingests an instruction that no plaintext scanner will ever see. The researchers demonstrated it on a Haiku 4.5 and Opus 4.7 pair, injecting into a benchmark run.

Put this into practice

None of this requires you to understand the cryptography. It requires you to change what you consider content.

Start by grepping what you have already published. Look for thinking and signature fields in Claude transcripts, encrypted_content on reasoning items in OpenAI payloads, and thoughtSignature in Gemini responses. Anywhere you have committed raw API request or response bodies (eval harness outputs, reproduction repos, issue attachments, agent trace dumps, dataset cards) you have shipped content you never read.

Then fix your sanitizer. Every secret-scanning and redaction script in existence targets visible text. A tool that catches an API key in a Bash tool call will happily wave through the same key sitting in the thinking block two lines above it. Until scanners understand these fields, the only safe rule is to strip reasoning blocks entirely before anything leaves your machine.

Change your storage default. If you persist conversation state to a database, a queue, or an S3 bucket, the reasoning blocks are going with it. Treat that column as sensitive, encrypt it at rest yourself, and set a retention window. Right now most teams treat it as inert padding.

Rotate what an agent thought about. If you have published trajectories from an agent that had access to real credentials, rotate those credentials. Do not audit first and rotate later. The decode is cheap enough that anyone who wanted them already has them.

If you publish rollouts, strip rather than keep. Benchmark authors and eval maintainers are the highest-volume publishers of these traces, and they are publishing other people's reasoning as much as their own.

Where this stops being alarming

Several things cut against the panic reading, and I would rather name them than let the numbers do all the work.

The headline extraction result is patched. The authors disclosed to all three providers before publication, and they state that as of August 2026 the Figure 1 results no longer reproduce with the attack described in Section 2.4, because of mitigations the providers shipped. Read that scope carefully. It covers the extraction recipe. The paper makes no claim that the secret-recovery, jailbreak-uplift, or injection vectors are closed. And it never says which mitigations landed, so you cannot tell from outside whether gateways now enforce cross-model isolation or whether the decoder models got a new refusal pattern, and those two fixes have very different half-lives.

The leak rate at the block level is genuinely small. 0.3% is 0.3%. I lean on the 4.9% per-session figure because sessions are the unit people publish, but a reader who thinks that framing is doing work is right to say so.

Benchmark traces inflate the raw PII counts. Agent benchmarks like ClawBench hand the model a complete synthetic persona, which is why the all-sources total climbs to 912 distinct privacy artifacts. I have quoted only the genuine-user-session credential numbers above for exactly that reason.

The anti-distillation vector, which is the paper's first and most academically interesting result, is not your problem. That one costs Anthropic, OpenAI, and Google money. It does not cost you anything.

And this is one v1 preprint from one team, describing one disclosure round. The compatibility tables are worth reading yourself before you repeat them.

The habit worth keeping

The headline hole is closed. The habit that made it dangerous is not.

Stateless agent architectures work by handing state to the client and asking the client to carry it back. That pattern is everywhere now, and it will keep spreading, because it is the cheapest way to build. Every blob a provider asks you to hold and return is a piece of your session sitting in your storage, your logs, and eventually your public repositories, in a format you were told not to look inside.

Go look at what your agent has been carrying. You paid for those tokens. You are allowed to know what is in them.

Sources: Stealing Reasoning Traces from Proprietary LLM APIs (arXiv:2608.09867), full PDF.