Quick Take
- The finding: LLM providers hide reasoning by returning it to the client as encrypted blocks. Those blocks are interchangeable across sessions, users and models of the same provider, so a weaker, less safeguarded model can be made to decode a stronger model’s reasoning and print it verbatim.
- Real-world leakage: Decoding 315,320 reasoning blocks scraped from public repositories recovered 367 personally identifiable information artifacts and 182 credentials.
- What it means: Client-side encrypted reasoning is not a secure container. The authors disclosed the issue to providers and propose cryptographic and system-level fixes.
Frontier language models increasingly reason in a hidden chain of thought before answering. Providers such as Anthropic, OpenAI and Google hide those traces to protect intellectual property and limit leakage. Instead of storing them on the server, they return them to the client as encrypted blocks, which the client sends back on the next turn. A MATS Research, ELLIS Institute Tübingen, Max Planck Institute for Intelligent Systems, University of Tübingen, Snyk and AI Sequrity Company team shows that this design has a dangerous flaw.
What the study shows
The encrypted blocks are fully compatible and interchangeable across different sessions, users and models within a provider’s ecosystem. The attack is simple: take an encrypted reasoning block from a capable model, inject it into a weaker model from the same provider, and ask that model to continue. It decodes and outputs the stronger model’s reasoning in plaintext, without jailbreaking the capable model itself.
- Works across the big three: The authors demonstrate extraction on Anthropic, OpenAI and Google APIs, using weaker models as fuzzy decoders for stronger ones such as Claude Opus.
- Fidelity looks high: On 120 Codeforces problems, the token count of the extracted reasoning tracked the API’s reported thinking-token count closely for most inputs, which the authors treat as evidence of high fidelity, though they lack ground-truth plaintext.
- Public logs leak secrets: Of 315,320 decoded thinking blocks, 0.3% (1,028) contained at least one privacy leak. Of 6,708 sessions, 4.9% (328) leaked at least one real sensitive item. In total the authors recovered 367 PII artifacts and 182 credentials.
- Hidden refusals: Even when a model’s visible answer safely refuses a malicious request, the decoded reasoning can still contain hazardous information from intermediate steps.
- Invisible prompt injection: Attackers can embed malicious payloads entirely inside encrypted blocks to poison public agentic rollouts, because other clients will replay those blocks without being able to read them.
- Distillation is cheap: Decoding 10,000 Claude traces with 12k-token windows would cost about $720 at Claude Haiku 4.5 rates.
Why it matters: opaque does not mean safe
Developers share session logs assuming the encrypted blocks are meaningless. They are not. Once decoded by a weaker sibling model, those blocks become plaintext reasoning that may contain personal data, API keys and intermediate reasoning the vendor intended to hide.
The attack also undermines anti-distillation. Competitors can extract reasoning from a strong model via a cheap decoder in the same ecosystem, without ever jailbreaking the strong model.
Method in brief
Controlled extractions used self-generated reasoning blocks on AIME 2025, Codeforces and Humanity’s Last Exam queries through the Anthropic, OpenAI and Google AI Studio APIs. The public scan decoded blocks scraped from public repositories. The authors spent about $30,000 on API credits. Provider-specific pipelines and mitigations are detailed in the appendices.
What remains open
- Provider APIs change: Testing covered Anthropic, OpenAI and Google as of early July 2026. Cryptography can change without notice.
- No ground-truth plaintext: Fidelity is inferred from token counts and qualitative matches, not byte-for-byte comparison with the model’s private reasoning.
- Targeted, not exhaustive scan: The public-repository scan is a demonstration of risk, not a full audit of all published agent datasets.
- Responsible disclosure: The paper states the authors disclosed the issue; it does not detail each provider’s response timeline.
Context
The work extends earlier research on reasoning leakage and distillation. Prefilling experiments with Moonshot AI’s Kimi-K3 show that even approximate Claude-style reasoning can shift another model’s visible answers. Related security research is in Safety & Alignment.
What it means for API providers and developers
- Bind encryption to session and model: Encrypted blocks should not be replayable across users, sessions or model tiers.
- Stop publishing opaque blocks: Do not share logs that contain encrypted thinking; they are decryptable.
- Prefer server-side storage: Keeping reasoning on the server avoids shipping an opaque, portable secret to every client.
- Rotate exposed credentials: Treat any public agent log that includes thinking signatures as potentially compromised.
About the analysis
Researched and written with AI assistance under the editorial responsibility of the i10X News team. The title image is an AI-generated illustration. Read our AI Use Policy. Spotted an error? Request a correction.
This article is based on the full text of the preprint “Stealing Reasoning Traces from Proprietary LLM APIs” (arXiv:2608.09867v1, submitted August 10, 2026). All numbers are taken from the paper’s text, tables and figures; i10X did not rerun the experiments. The chart was redrawn by i10X from the public-repository scan of the paper, which is published under a CC BY 4.0 license.
i10x Perspective
Hiding chain-of-thought behind encryption looked like a clever compromise between IP protection and multi-turn continuity. This paper shows the compromise fails if the ciphertext is portable. The most chilling number is not technical: hundreds of credentials sitting in public repositories inside blocks their owners thought were unreadable. Opaque is not the same as confidential.
