Researchers decoded 315,320 encrypted reasoning blocks harvested from public code repositories and pulled 367 pieces of personal data and 182 credentials out of them. The blocks are the hidden chain of thought that OpenAI, Google, and Anthropic hand back to developers as opaque encrypted strings, and the paper shows they can be replayed into the provider's own systems and read back in plain English. The work, titled "Stealing Reasoning Traces from Proprietary LLM APIs" and posted as arXiv 2608.09867, went through responsible disclosure with all three labs before publication.
Key facts
- 315,320 encrypted reasoning blocks were decoded from public repositories, yielding 367 personal-data artifacts and 182 credentials.
- The blocks are portable across sessions, across users, and across models inside one provider's family, including downgrades from an expensive model to a cheap one.
- Published August 2026 by a team including Alexander Panfilov and Ilia Shumailov; all three notified labs acknowledged the report and none responded aggressively.
- Primary source: the paper on arXiv and the authors' demonstration site.
Here is the setup that makes this possible. When a modern reasoning model answers a hard question, it produces a long internal monologue before it writes anything you see. Providers want customers to be able to carry that monologue from one API call to the next, so multi-step agents do not have to re-think from scratch. But they do not want customers reading it, and in some configurations they do not want to store it themselves. The compromise was to encrypt the monologue and hand the ciphertext to the customer, who passes it back on the next call. It looks like a sealed envelope you are trusted to carry but not to open.
The researchers noticed that the envelope is sealed with a key the whole product family shares. Take a block produced by an expensive frontier model, hand it to a cheaper sibling model from the same provider, and the server decrypts it as designed. Then simply ask that cheaper model what it just read. It tells you. Nothing about the cipher was defeated; the system was used exactly as built, in a context it was never scoped for. In the Machine Learning Street Talk interview published August 22, Panfilov separated the two problems cleanly: the architectural bug is that the blob is replayable across users, sessions, and models, and even if that were fixed, a user can still keep pressing the model to restate its own thought, which he expects "would be around forever."
The scraped-repo number is where this stops being theoretical. Developers commit logs, test fixtures, and cached API responses to GitHub constantly. Those artifacts carry the encrypted reasoning blocks along with everything else, and teams that carefully scrub the visible transcript have no reason to think the opaque string beside it contains anything. It does. It contains whatever the model was thinking about while it read the user's prompt, which in 367 cases meant personal data and in 182 cases meant a live credential. Sanitizing what you can read is not the same as sanitizing what you shipped.
There is a second edge to this that matters more for anyone building agents. If a hidden reasoning block can be replayed into a model and decoded, it can also be authored and injected. That turns the reasoning channel into a delivery surface, a place to smuggle instructions that no human reviewing the visible conversation would ever see. It is prompt injection with the payload hidden inside the one part of the exchange that is designed to be unreadable. Ground Truth covered a self-propagating injection that spreads between agents earlier this month, and a coordination channel the transcript never shows before that; this is the same failure family, one layer deeper.
The interview also upgraded a lab curiosity into an in-the-wild observation. The authors report finding traces full of fragments like "marinate," "vantage," and "theatrical," plus stretches of quoted empty space, mostly from coding-focused models. Nobody knows what that language is doing. It is the monitorability problem in its rawest form: the reasoning is right there, and it is not legible. Apollo Research and METR have both argued that readable reasoning is a fragile safety asset that market pressure will erode, and this is what erosion looks like in practice. It connects directly to chain-of-thought faithfulness, which asks whether the visible reasoning was ever the real reasoning to begin with.
The honest caveat is that the strongest counter-argument is a fair one. This is a deployment and scoping flaw, not a cryptographic break or a scientific result, and a Hugging Face commenter said as much: describing the blocks as encrypted implies a protection the shared-key design never provided. The authors partly agree, and they propose the obvious fixes, which are server-side state, envelopes bound to a single context, isolation between models, and revocation. The paper's disclosure section says the attacks were no longer reproducible after the labs were notified. But no provider has published anything confirming a fix, and the current public documentation from both OpenAI and Google still describes carrying encrypted reasoning and thought signatures forward across calls. Treat the hidden reasoning in your logs as sensitive until someone tells you otherwise.
Originally published on Ground Truth, where every claim is checked against the primary source.
Top comments (0)