The feature that was supposed to be a black box
Reasoning models from OpenAI, Anthropic, and Google generate hidden chain of thought before answering, and to preserve that reasoning across turns without exposing plaintext, providers wrap it in encrypted blocks that clients pass back and forth without being able to read. The design goal was straightforward: let a developer maintain conversational state without handing them the model's internal deliberation, which vendors treat as proprietary intellectual property and, in some cases, as a genuine safety boundary against models reasoning openly about how to circumvent their own guardrails or produce content they are trained to refuse.
A paper published August 12, titled Stealing Reasoning Traces from Proprietary LLM APIs, shows that boundary was considerably leakier than the encryption implied to anyone relying on it. The researchers built on earlier work by Johns Hopkins cryptographer Matthew Green, who first reported replay behavior to OpenAI and Anthropic back in May. OpenAI deemed it unreproducible at the time and Anthropic judged it to carry no meaningful security implications. Neither assessment held up once this new research team pushed the underlying technique considerably further than Green's original report.
How a cheaper model became the decoder
The core insight did not require cracking any encryption at all, which is what makes it so uncomfortable for the vendors involved. Reasoning blocks created by a stronger model remained valid when submitted to a weaker, compatible model from the same family, and that weaker model could simply be prompted to transcribe whatever content it received inside the block. The researchers called these fuzzy decoders: Claude Haiku 4.5 for Claude traces, GPT-5.6 Luna for GPT traces, and Gemini Robotics ER-1.6 for Gemini traces. Feed a stronger model's encrypted block to its cheaper sibling, ask it plainly to describe what is inside, and the sibling obliges without hesitation.
That cross-model acceptance is the actual vulnerability, and it is a design flaw rather than a cryptographic one. It means the encryption was protecting the format of the block, not the content locked inside it, and any party with ordinary API access to a lower tier of the same model family effectively had a working key the whole time. No credentials needed to be stolen and no cryptography needed to be broken, only an assumption about model isolation that quietly turned out not to hold under scrutiny.
What actually came out of production traces
The team ran the technique against 6,708 publicly available agent trajectories, the kind of shared transcripts that show up routinely in bug bounty writeups, academic papers, and open evaluation datasets, and decoded 315,320 individual thinking blocks from that corpus. Within 704 distinct privacy artifacts pulled from genuine user sessions, they recovered 62 API keys, 33 passwords, 24 access tokens, and 7 private keys, exactly the kind of secrets that end up embedded in agent transcripts whenever an AI system is handed real credentials to complete real work on someone's behalf.
The more unsettling figure in the paper is 64: the number of recovered artifacts that appeared only inside hidden reasoning and were completely absent from the sanitized visible output shown to a human reviewer. Any organization that reviewed only the visible transcript of an agent session, which is standard practice almost everywhere, would have confidently concluded the interaction was clean. The secret sat there the entire time, encrypted and just one carefully worded prompt away from a weaker model reading it back out loud in plain text.
This is a model distillation and safety problem too
Beyond straightforward credential theft, the researchers demonstrated the technique also supports model distillation through proprietary reasoning theft, letting a well-resourced competitor extract a frontier model's actual reasoning patterns via public traces rather than paying for the enormously expensive training run that produced them in the first place. That is a direct hit to the economics labs use internally to justify keeping frontier reasoning opaque, and it undercuts a competitive moat several vendors have leaned on heavily.
It also breaks a load-bearing safety assumption several labs have built policy around. Hidden reasoning is where labs expect a model to work through content it will ultimately refuse to state plainly to the user, and invisible prompt injection through opaque reasoning blocks is one of several attack scenarios the paper goes on to demonstrate in detail. If hidden reasoning turns out to be recoverable by ordinary third parties with API access, the safety value of hiding it from users in the first place gets substantially thinner.
The fixes are inconsistent across vendors
Vendor response to the disclosure has not been uniform, which is itself worth noting for anyone building governance around these APIs. Anthropic now ties thinking blocks explicitly to the producing model and instructs developers that they should be stripped whenever a session switches models mid-conversation. Google's backend now manages thought compatibility automatically across model switches on its side, removing the decision from the developer entirely. OpenAI's documentation, as of this writing, still instructs developers to replay encrypted reasoning for stateless history management, which is the exact pattern the researchers exploited to build their extraction technique.
None of the three vendors has issued a public acknowledgment explicitly tying their documentation changes to this specific research, and the researchers themselves note that the primary extraction attack no longer reproduces as of August 2026 following those quiet changes. That is a meaningful mitigation worth crediting, but it does not retroactively secure the reasoning traces already sitting in public GitHub repositories, shared evaluation datasets, and archived agent logs published before any of the fixes shipped.
What this means for anyone running agents in production
If your agent stack passes real credentials into a session and then logs or publishes the resulting transcript for debugging, training data, or a public writeup, encrypted reasoning blocks were never the safe container most teams assumed they were. Audit anywhere your organization has published agent trajectories publicly, whether in bug bounty writeups, conference talks, or open evaluation sets, and treat any credentials referenced anywhere in those sessions as potentially exposed regardless of what the visible, sanitized text on the page actually shows a reviewer.
Longer term, this is a useful reminder that opaque formats do not automatically mean secure ones, and vendor assurances about proprietary encoding deserve exactly the same scrutiny you would give an openly documented format. Push your model providers for explicit, written answers on cross-model replay behavior before you build governance controls that quietly assume encrypted reasoning is actually private by default. The gap between those two assumptions is precisely where this entire incident lived undetected for months.
