Paper: Vendors' Encrypted Chain-of-Thought Can Be Unlocked by a Weaker Model From the Same Provider—Demonstrated on Anthropic, OpenAI and Google

A paper submitted August 10 (arXiv:2608.09867) shows that the encrypted blocks providers use to hide a model's chain-of-thought—returned to the client and passed back each turn—are fully interchangeable across sessions, users and models within one provider's ecosystem. Feed a strong model's encrypted block to a weaker, less guarded sibling and it will decode the trace verbatim into plaintext, without ever jailbreaking the stronger model. The team decoded 315,320 reasoning blocks scraped from public repositories and recovered 367 pieces of personally identifiable information and 182 credentials.

The Flaw Is Architectural, Not Cryptographic

Reasoning models generally no longer keep their chain-of-thought server-side. Instead it comes back as an encrypted block of text that the client passes along with the next request—cheaper for the provider, and it lets vendors say the reasoning never leaks. The problem the paper identifies is that those blocks are fully interchangeable inside one provider's ecosystem: change the session, change the user, even change the model, and they are still accepted and parsed. That makes the attack almost mundane. Take an encrypted block produced by a capable model, hand it to a weaker, less safeguarded model from the same provider, and ask it to decode and echo the contents. The authors call this a scalable decryption jailbreak and say they demonstrated it across Anthropic, OpenAI, and Google.

Four Attack Paths

First, it defeats anti-distillation: hiding the chain-of-thought exists precisely to stop competitors from distilling it, and this removes the barrier. Second—and this is the one that should worry developers most—it enables large-scale private data extraction. Developers routinely publish session logs and agent trajectories without knowing what those encrypted blocks contain; decoding 315,320 blocks scraped from public repositories yielded 367 PII artifacts and 182 credentials. Third, it surfaces hazardous content that the visible answer safely refused: the model declines on the surface while the reasoning has already worked the problem through. Fourth, invisible prompt injection—a malicious payload hidden entirely inside an encrypted block, poisoning agent rollouts that circulate publicly and look clean to a human reader.

Still Unconfirmed

The authors say they completed responsible disclosure and propose concrete cryptographic and system-level mitigations. As of verification, though, neither the paper nor press coverage states whether the three providers have shipped fixes or on what timeline, and no third-party reproduction has appeared. These findings currently rest on one research team's experiments—worth keeping in mind when reading the numbers.

Why It Matters

There is one action developers can take immediately: stop publishing session logs and agent trajectories that still contain encrypted reasoning blocks to GitHub or Hugging Face. Those blocks are not opaque binary—by the paper's method they are recoverable plaintext, and they may carry the keys, customer data, and internal paths you fed in while debugging. The same goes for agent traces your CI archives automatically: strip the reasoning fields before export. For buyers, there is a second lesson. When a vendor says the chain-of-thought does not leak, that means it is not displayed—not that a third party cannot obtain it.

via: Stealing Reasoning Traces from Proprietary LLM APIs (arXiv:2608.09867); project page stolen-thoughts.com; verified 2026-08-12