The Flaw Is Architectural, Not Cryptographic
Reasoning models generally no longer keep their chain-of-thought server-side. Instead it comes back as an encrypted block of text that the client passes along with the next request—cheaper for the provider, and it lets vendors say the reasoning never leaks. The problem the paper identifies is that those blocks are fully interchangeable inside one provider's ecosystem: change the session, change the user, even change the model, and they are still accepted and parsed. That makes the attack almost mundane. Take an encrypted block produced by a capable model, hand it to a weaker, less safeguarded model from the same provider, and ask it to decode and echo the contents. The authors call this a scalable decryption jailbreak and say they demonstrated it across Anthropic, OpenAI, and Google.
Four Attack Paths
First, it defeats anti-distillation: hiding the chain-of-thought exists precisely to stop competitors from distilling it, and this removes the barrier. Second—and this is the one that should worry developers most—it enables large-scale private data extraction. Developers routinely publish session logs and agent trajectories without knowing what those encrypted blocks contain; decoding 315,320 blocks scraped from public repositories yielded 367 PII artifacts and 182 credentials. Third, it surfaces hazardous content that the visible answer safely refused: the model declines on the surface while the reasoning has already worked the problem through. Fourth, invisible prompt injection—a malicious payload hidden entirely inside an encrypted block, poisoning agent rollouts that circulate publicly and look clean to a human reader.
Still Unconfirmed
The authors say they completed responsible disclosure and propose concrete cryptographic and system-level mitigations. As of verification, though, neither the paper nor press coverage states whether the three providers have shipped fixes or on what timeline, and no third-party reproduction has appeared. These findings currently rest on one research team's experiments—worth keeping in mind when reading the numbers.
Why It Matters
There is one action developers can take immediately: stop publishing session logs and agent trajectories that still contain encrypted reasoning blocks to GitHub or Hugging Face. Those blocks are not opaque binary—by the paper's method they are recoverable plaintext, and they may carry the keys, customer data, and internal paths you fed in while debugging. The same goes for agent traces your CI archives automatically: strip the reasoning fields before export. For buyers, there is a second lesson. When a vendor says the chain-of-thought does not leak, that means it is not displayed—not that a third party cannot obtain it.
via: Stealing Reasoning Traces from Proprietary LLM APIs (arXiv:2608.09867); project page stolen-thoughts.com; verified 2026-08-12