Key Notes
- Researchers from MATS, the Max Planck Institute, ELLIS Institute Tübingen and Snyk found that encrypted "chain-of-thought" reasoning blocks are portable across a provider's model family, so a block from a strong model can be replayed into a weaker sibling that transcribes the hidden reasoning verbatim, without breaking any encryption key.
- The paper reports 367 pieces of personal data and 182 credentials, with a fuller analysis citing 704 secrets total, including dozens of API keys and passwords hidden in blocks developers had shared unknowingly.
- The flaw also exposed hazardous content in reasoning even when the visible answer refused, and enabled invisible prompt injections.
Researchers have disclosed an architectural vulnerability in how OpenAI, Anthropic and Google protect the hidden “chain-of-thought” reasoning their flagship models generate before answering. The work, titled “Stealing Reasoning Traces from Proprietary LLM APIs,” comes from a team spanning MATS Research, the Max Planck Institute for Intelligent Systems, the ELLIS Institute Tübingen, the University of Tübingen and the security firm Snyk.
Modern reasoning models think through a problem step by step before replying. Because that internal reasoning contains commercial intellectual property and safety checks, providers do not return it in plain text. Instead they encrypt it, send it to the user as an opaque block, and have the client pass it back on the next turn to preserve context.
The researchers found that these encrypted blocks are not tied to their original session, user, or even model. Within a provider’s ecosystem, a block is interchangeable, and that portability is the flaw.
The core attack exploits a security gap between siblings. Flagship models like Claude Opus 4.8 or GPT-5.6 Sol carry strong refusal training to prevent them from disclosing their internal reasoning. Their cheaper, faster siblings, such as Claude Haiku 4.5 or GPT-5.6 Luna, are optimized for cost and often lack those defenses.
By capturing an encrypted reasoning trace from a strong model and injecting it into a weaker one from the same family, then instructing the weaker model to transcribe it, the researchers forced the smaller model to output the flagship’s hidden reasoning verbatim, all without ever breaking the encryption or attacking the stronger model directly. They describe the weaker model as an “unwitting decryption oracle.”
Why This Matters Beyond Distillation
The immediate concern is anti-distillation: the technique lets a rival extract a proprietary model’s reasoning, exactly the kind of theft providers built the encryption to prevent, and the paper suggests such extraction may have been quietly possible for some time.
But the more tangible harm is data exposure. Developers routinely share AI agent session logs publicly, often unaware the attached encrypted blocks contain readable content. Scraping thousands of public trajectories from GitHub and Hugging Face, the researchers decoded roughly 315,000 reasoning blocks and recovered real secrets buried inside them.
The paper’s abstract reports 367 pieces of personally identifiable information and 182 credentials, while a fuller analysis of the same dataset cites 704 secrets in total, including dozens of API keys and passwords. These were sensitive artifacts sitting in plain sight, invisible in the visible prompt or final answer but recoverable from the hidden reasoning.
The study identified two further risks. Decoded reasoning sometimes revealed hazardous information even when the model’s final, visible answer had safely refused the request, and attackers could hide malicious instructions entirely inside encrypted blocks to carry out invisible prompt injections that poison public agent data.
Responsible Disclosure and the Fix
The researchers followed responsible disclosure, reporting the issues to OpenAI, Anthropic and Google before publishing. According to the team, the labs have already patched several of the problems and are continuing to work on mitigations, and the paper proposes cryptographic and system-level fixes such as binding each encrypted block to its specific session so it cannot be replayed elsewhere.
The episode carries a broader lesson about a design tradeoff the industry made for convenience. Returning encrypted reasoning to the client, rather than storing it server-side, reduces provider costs but shifts sensitive material outside the provider’s walls, where its protection depends on assumptions that this research shows can fail.
The practical takeaway for developers is immediate and does not depend on any single vendor’s patch: treat AI agent logs as potentially sensitive and avoid publishing raw session traces, since the encrypted blocks they contain may not be as opaque as they appear. As reasoning models become the backbone of autonomous agents, securing the hidden layer where they do their thinking is becoming as important as securing their visible outputs.
Disclaimer: AIstify is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and insights on artificial intelligence, emerging technologies, automation, and related industries. NuvexMedia LLC invests in and collaborates with companies across the AI, technology, software, and digital innovation sectors. These relationships do not influence AIstify’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2026 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
