Encrypted reasoning blocks were supposed to preserve API continuity without exposing a model's full chain of thought. A new paper shows that this design can also become a decoding handle.
On August 10, Alexander Panfilov, David Schmotz, Ilia Shumailov and five coauthors submitted “Stealing Reasoning Traces from Proprietary LLM APIs” to arXiv. The Decoder covered the research on August 11. The paper and project site say that encrypted reasoning traces returned by APIs from OpenAI, Anthropic and Google can be replayed across sessions, users and sibling models inside the same provider ecosystem.
“Proprietary reasoning can be recovered from its encrypted traces.”
The weak point is stateless context
Reasoning-model providers hide chain-of-thought to protect IP and safety behavior. To keep conversations continuous, they return encrypted reasoning blocks to the client and expect the client to send those blocks back in later requests.
The convenience is clear: the provider does not need to store full state for every conversation. The risk is that the blocks may be portable. The researchers describe a two-step attack: obtain a frontier model's encrypted reasoning block, inject it into a cheaper and less guarded sibling model, and jailbreak the sibling into transcribing the hidden trace.
The paper's example uses a Claude Opus 4.8 reasoning signature replayed into Claude Haiku 4.5, which then outputs plaintext reasoning. The authors say they demonstrated the class of issue across Anthropic, OpenAI and Google APIs.
Public logs already contain secrets
The team collected 6,708 public agent trajectories from GitHub and Hugging Face that still contained encrypted reasoning blocks from Claude, GPT and Gemini models. Their decoding pipeline reconstructed 315,320 reasoning blocks.
After filtering to real user sessions, the project site reports 704 distinct privacy artifacts, including 62 API keys, 33 passwords, 24 access tokens and 30 personal email addresses. The arXiv abstract groups the findings as 367 PII artifacts and 182 credentials. Those are different accounting views of the same problem: developers may have published opaque encrypted text while also publishing secrets the model saw internally.
Agent logs need a new cleaning rule
The authors say they disclosed the issue to affected API providers, Microsoft and Hugging Face before publication. Mitigations point toward stronger binding of encrypted blocks to sessions, users, models and purposes, plus stricter sanitation for public agent datasets.
For engineering teams, the practical lesson is immediate: remove reasoning signatures, encrypted_content and thinking-block fields before sharing traces; scan agent logs for credentials beyond visible chat messages; and check whether old traces must be deleted or rotated after provider fixes.
Sources: arXiv:2608.09867, Stolen Thoughts research site, The Decoder, CocoLoop, Hugging Face Papers; verified submission timing, publication timing, OpenAI/Anthropic/Google API scope, 315,320 reconstructed blocks, 6,708 public trajectories, 704 privacy artifacts, 367 PII artifacts and 182 credentials.