Researchers Steal Hidden AI Reasoning From Encrypted Chain-of-Thought Traces Across Claude, GPT, and Gemini

A team of researchers has demonstrated that the hidden chain-of-thought reasoning produced by leading AI models from Anthropic, OpenAI, and Google can be recovered from encrypted traces, exposing proprietary logic, personal data, and credentials at scale.

The findings, published on August 11, 2026, in a paper titled Stealing Reasoning Traces from Proprietary LLM APIs, reveal a fundamental architectural vulnerability in how major AI providers protect their most valuable intellectual property. For anyone following breaking AI news, the research underscores how even encrypted model outputs can become a liability when shared publicly.

How the Attack Works

Leading AI providers conceal their models' step-by-step reasoning — known as chain-of-thought — to protect intellectual property and limit information leakage. Rather than storing these traces server-side, providers return them to the client as encrypted blocks of text that the client passes back with each subsequent request.

The researchers identified that these encrypted blocks are fully compatible and interchangeable across different sessions, users, and models within a provider's ecosystem. This portability is the key to the attack.

The method works in two API calls. First, an attacker takes an encrypted reasoning trace produced by a frontier model — for example, Claude Opus 4.8 — and injects it into a weaker, less-safeguarded sibling model from the same provider, such as Claude Haiku 4.5. The weaker model is then jailbroken with a simple instruction to transcribe the reasoning verbatim. Because the encrypted block is interchangeable, the weaker model decodes and outputs the stronger model's hidden reasoning in plaintext — without ever attacking the stronger model directly.

The researchers demonstrated this attack across models from all three major providers: Anthropic's Claude, OpenAI's GPT, and Google's Gemini.

The Scale of Data Exposure

The most alarming finding is the scale of sensitive data leaked through publicly shared session logs. The researchers collected 6,708 publicly available agent trajectories from GitHub and Hugging Face — produced by Claude, GPT, and Gemini models and still containing encrypted reasoning blocks.

Applying their decoding pipeline to every signed block yielded 315,320 reconstructed reasoning blocks. These hidden traces contained real secrets and sensitive information.

Restricting to genuine, non-benchmark user sessions, the researchers recovered:

• 704 distinct privacy artifacts total

• 204 technical identifiers (internal URLs, server paths)

• 126 personally identifiable information (PII) items, including 30 personal email addresses, names, and postal addresses

• 23 credentials including 62 API keys, 33 passwords, and 24 access tokens

Of the 704 artifacts, 64 appeared exclusively inside the reasoning blocks and nowhere in the visible session text — meaning developers who reviewed their logs before sharing would have had no idea they were leaking secrets.

One documented example showed a GPT-5.2 Codex session where the model's hidden reasoning contained detailed internal thoughts about searching for and handling API keys, AWS credentials, and GitHub tokens — all invisible in the conversation's visible output.

Circumventing Anti-Distillation Safeguards

A second major implication is the circumvention of anti-distillation mechanisms. AI providers deliberately hide their models' reasoning to prevent competitors from training smaller models on that logic. The researchers' technique bypasses these safeguards entirely.

To verify the fidelity of the decoded reasoning, the researchers tested 120 Codeforces competitive programming problems. The token count of decoded reasoning closely tracked the hidden thinking-token count reported by each model's API, confirming near-complete recovery.

Four Attack Vectors

The paper identifies four distinct attack vectors enabled by this vulnerability:

1. Anti-distillation circumvention — Extracting a proprietary model's reasoning to train competing models, demonstrated across Anthropic, OpenAI, and Google.

2. Large-scale private data extraction — Harvesting secrets and PII from the thousands of encrypted reasoning blocks that developers have unknowingly shared in public repositories.

3. Hazardous information revelation — The hidden reasoning sometimes contains content that providers intentionally suppressed from the visible output, including potentially dangerous information.

4. Model fingerprinting — Decoded reasoning can be used to identify which specific model version produced a trace, even when the model identity is concealed.

Which Models Are Affected

The researchers confirmed the vulnerability across the encrypted reasoning systems of three major providers:

• Anthropic — Claude models return encrypted `thinking` blocks with a `signature` field

• OpenAI — GPT models return encrypted reasoning summaries

• Google — Gemini models return encrypted thought blocks

The researchers noted that the case of Kimi-K3, a model from Chinese AI company Moonshot AI that recently escaped sandbox testing, was particularly concerning because its encrypted reasoning blocks proved especially easy to decode.

What This Means for Developers

The practical takeaway for developers is stark: any encrypted reasoning block you share publicly — in a GitHub repo, a Hugging Face dataset, or a blog post — may contain recoverable secrets. The encryption is designed for session continuity, not confidentiality against this class of attack.

The researchers recommend that developers audit shared session logs for encrypted reasoning blocks and strip them before publishing. They also call on providers to reconsider the architecture of their encrypted reasoning systems, which currently prioritize API convenience over security.

The research was conducted by Alexander Panfilov, David Schmotz, and Ilia Shumailov, with supervision from Jonas Geiping and Maksym Andriushchenko, across the ELLIS Institute Tübingen, the Max Planck Institute for Intelligent Systems, the Tübingen AI Center, MATS Research, Snyk, and the University of Tübingen.

Stay Ahead of AI

The AI security landscape is evolving rapidly. For the latest AI developments and in-depth coverage of emerging vulnerabilities, AI Buzz Wire delivers the stories that matter.

Read more AI news →