A new research paper says encrypted reasoning blocks used by major AI providers can be replayed through weaker compatible models, potentially exposing hidden reasoning, credentials and other sensitive information.
A newly published security paper has identified a potential architectural weakness in how major AI providers protect hidden reasoning traces, showing that encrypted reasoning blocks can be extracted by passing them to compatible but less restricted models within the same provider ecosystem.
The research, “Stealing Reasoning Traces from Proprietary LLM APIs,” was authored by researchers affiliated with MATS Research, the ELLIS Institute Tübingen, the Max Planck Institute for Intelligent Systems, the Tübingen AI Center, Snyk and the University of Tübingen.
The researchers tested the technique against APIs from Anthropic, OpenAI and Google, arguing that the problem stems from the portability of encrypted reasoning blocks across models, users and sessions.
Voldemaras Kadys (https://www.linkedin.com/in/voldemaras-kadys/), the Head of Security at Cybernews, with over 15 years of experience in cybersecurity and IT infrastructure, comments:
“The most interesting part of this research is that the researchers didn’t need to ‘break’ the encryption in the traditional sense. They found that encrypted reasoning traces could be passed between compatible models within the same provider’s ecosystem, effectively turning a weaker model into a master decryption key. The main lesson here for users and organizations is this: if you’re using AI with sensitive inputs or outputs, treat chat logs as sensitive data, even when they look like meaningless encrypted text. Those encrypted blocks can contain credentials, personal information, and other sensitive data that isn’t visible to the person sharing the log. As this research demonstrates, encryption doesn’t necessarily make that information inaccessible, and the barrier to decrypt it may be much lower than users expect.”
The attack does not require breaking the encryption
Modern reasoning models generally do not return their full chain-of-thought in readable form. Instead, some APIs provide clients with opaque reasoning blocks that can be passed back to the provider to maintain context between requests.
According to the paper, these blocks use authenticated encryption mechanisms designed to protect confidentiality and integrity while allowing providers to avoid storing the reasoning state server-side.
The researchers found that the security boundary can become much weaker when those encrypted blocks are accepted by multiple models within the same provider ecosystem.
Their attack works by taking a reasoning block generated by a more capable, heavily safeguarded model and replaying it into a weaker compatible model. The weaker model can then be prompted to reproduce the hidden reasoning in plaintext.
The important distinction is that the researchers did not cryptographically break the underlying encryption. Instead, they exploited the model ecosystem’s ability to accept and process an authenticated reasoning block in another context.
The researchers describe this as a “decryption jailbreak,” with the compatible weaker model effectively becoming a decoding channel.
Anthropic, OpenAI and Google models tested
The researchers identified compatible decoder models for each ecosystem.
For Anthropic, they used Claude Haiku 4.5 to extract reasoning generated by stronger Claude models. For OpenAI, they used GPT-5.6 Luna, while Gemini Robotics 1.6 was used to process reasoning traces from multiple Gemini generations.
The researchers evaluated the extraction process using reasoning tasks and compared the amount of recovered reasoning with API-reported thinking-token counts. They caution, however, that they cannot guarantee every recovered token represents the model’s original private reasoning because the actual ground-truth reasoning is unavailable and model generation is stochastic.
That limitation is important: the paper demonstrates substantial extraction capability, but it does not claim perfect byte-for-byte recovery of every hidden reasoning trace.
Publicly shared AI logs exposed sensitive information
The privacy implications may be more significant than the model-distillation issue.
Developers increasingly publish AI agent trajectories, debugging logs and session transcripts on platforms such as GitHub and other public repositories. Even when the visible conversation has been sanitized, encrypted reasoning fields can remain in the underlying data.
The researchers scraped 315,320 encrypted reasoning blocks from publicly available repositories and reported recovering 367 personally identifiable information artifacts and 182 credentials. From genuine user sessions, the researchers identified 62 API keys, 33 passwords and 30 personal email addresses.
The paper’s detailed analysis found that 64 of 704 recovered genuine privacy artifacts appeared only inside reasoning, rather than in the visible chat history. The researchers say this could happen when users sanitize visible transcripts while leaving the encrypted reasoning blocks intact, or when information is introduced into hidden reasoning from model memory.
The researchers stress that their scan was targeted rather than an exhaustive audit of all publicly available AI traces.
The problem extends beyond data leakage
The research identifies four potential attack categories:
- Reasoning extraction and model distillation
- Extraction of credentials and personally identifiable information
- Hidden prompt injection
- Recovery of harmful information from protected reasoning
The prompt-injection scenario is particularly notable for emerging AI-agent deployments.
The researchers demonstrated a proof of concept in which an instruction embedded within an encrypted reasoning block could influence a model when the block was subsequently replayed. In one example, the injected instruction caused an agent to generate a PowerPoint-editing script that also uploaded the resulting presentation to an attacker-controlled server.
Because the malicious instruction exists inside an opaque reasoning block, conventional monitoring focused on visible prompts and responses may not see it.
Hidden reasoning can contain information absent from the final response
The researchers also tested whether hidden reasoning could expose information that a model’s visible answer had deliberately withheld.
In one experiment, the team prompted a stronger model with a harmful request. Although the model’s visible response remained benign, the researchers captured its encrypted reasoning and used a weaker compatible model to extract information from the hidden trace.
This raises a broader security question for AI providers: protecting the visible output may not be enough if the underlying reasoning channel remains accessible through another model.
The “weakest model” may become the security boundary
The paper’s central architectural concern is that security controls applied to frontier models may be undermined by less capable models that share access to the same encrypted reasoning format.
A powerful model can have strong anti-distillation and refusal safeguards, while a smaller model may not have equivalent protections. If both models can process the same authenticated reasoning block, an attacker may be able to move the protected data from the stronger model into the weaker one.
That creates an unusual security asymmetry: the security of the most protected model can depend partly on the behavior of the least protected compatible model.
Researchers say providers were notified
The researchers say they disclosed the vulnerabilities and extraction methods to the affected model providers, Microsoft and Hugging Face before publication.
According to the paper, all affected model providers acknowledged receipt of the report, and the researchers subsequently found that they could no longer reproduce the same attacks.
The paper does not provide detailed public explanations from each provider about what changes were made.
The researchers also note that their testing was conducted against specific API versions and models available in early July 2026, meaning provider-side changes could affect whether the techniques remain effective.
What should organizations do?
The researchers recommend that developers and organizations treat encrypted reasoning fields as potentially sensitive data rather than assuming that an opaque signature is harmless.
Among their recommendations is removing reasoning blocks and opaque reasoning fields from publicly released AI-agent trajectories when sensitive information may have been exposed. They also advise against retaining or committing raw API transcripts containing reasoning signatures to shared repositories or public version-control systems.
At the provider level, the researchers propose stronger cryptographic and system-level controls, including binding reasoning blocks to contextual information such as the originating user, session and model, rather than allowing broad replayability.
A broader warning for AI security
The research highlights an emerging challenge as AI models increasingly operate as agents rather than simple chat interfaces.
Reasoning traces can contain intermediate calculations, tool outputs, user information and contextual data that never appears in the final response.
That makes the security of these hidden channels increasingly important.
As AI agents gain access to code repositories, corporate systems, credentials and sensitive business data, an encrypted reasoning block may look meaningless to a human reviewing a log while still containing valuable information that another compatible model can potentially recover.
The researchers ultimately argue that AI systems need to balance proprietary reasoning protection with data transparency and verifiable security. Their conclusion is blunt: an architecture that hides sensitive information from the user while potentially allowing another party to extract it does not provide a sufficient privacy boundary.
