Threat · curated 17 Aug 2026
Stealing Reasoning Traces from Proprietary LLM APIs
First reported arxiv.org
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
Encrypted LLM reasoning blobs that developers share publicly are not opaque and can be decrypted to expose credentials, PII, hidden hazardous content, and even carry invisible prompt-injection payloads into agentic workflows.
A paper titled "Stealing Reasoning Traces from Proprietary LLM APIs" and a reproduction by embracethered describe an attack that recovers encrypted LLM chain-of-thought blobs by replaying them to a weaker, easier-to-jailbreak model from the same provider, which then decodes and outputs the hidden reasoning in plaintext. The technique exploits the interchangeability of encrypted reasoning blocks across sessions, users, and models at OpenAI, Anthropic, and Google; the researchers decoded 315,320 scraped reasoning blocks to recover 367 PII artifacts and 182 credentials, and the blogger reproduced the attack against OpenAI's GPT-5.6.
Summary
A research paper, 'Stealing Reasoning Traces from Proprietary LLM APIs,' documents an architectural vulnerability in how leading LLM providers (Anthropic, OpenAI, Google) return encrypted, client-held chain-of-thought reasoning. Because the encrypted reasoning blocks are interchangeable across sessions, users, and models within a provider's ecosystem, an attacker can inject a reasoning blob produced by a capable model into a weaker, less-safeguarded model from the same provider and force it to decode and output the trace in plaintext without ever jailbreaking the stronger model directly.[1][2]
The impact is demonstrated at scale: by decoding 315,320 reasoning blocks scraped from public repositories, the researchers recovered 367 pieces of PII and 182 credentials including API keys and passwords, showing that shared session files containing 'opaque' encrypted blobs can leak substantial sensitive information. The paper enumerates four distinct attack vectors—anti-distillation circumvention, private data extraction, hazardous-information disclosure, and invisible prompt injection.[1][2]
An independent researcher reproduced the technique against OpenAI's GPT-5.6, extracting reasoning content (including a known password) from traces generated in one account by replaying the encrypted blob to GPT-5.6 Luna in a separate account. Reproduction was intermittent—working, then failing for several days, then working again—suggesting backend or model-behavior variability. The work follows responsible disclosure, and the authors propose cryptographic and system-level mitigations.[1][2]
Attack chain
- Obtain encrypted reasoning blob: An attacker collects an encrypted reasoning trace, either from their own session or lifted from a publicly shared session file (e.g., Codex session files stored under ~/.codex/sessions/YYYY/MM/DD), where reasoning payloads carry the trace in the encrypted_content field.[1]
- Replay blob to a weaker compatible model: The encrypted blob is replayed as valid context to a different, less-safeguarded model from the same provider (e.g., GPT-5.6 Luna), which the provider accepts because the encrypted blocks are interchangeable across sessions, users, and models.[1][2]
- Jailbreak to transcribe the trace: A minor jailbreak prompt instructs the receiving model to transcribe the attached reasoning 'thought' exactly, causing it to decode and output the underlying reasoning—including any secrets such as passwords—in plaintext.[1][2]
Disclosure timeline
| Date | Event |
|---|---|
| May 29, 2026 | Matthew Green publishes work showing encrypted reasoning blobs can be replayed across sessions, accounts, and (for OpenAI) models.[1] |
| August 10, 2026 | Paper 'Stealing Reasoning Traces from Proprietary LLM APIs' posted as arXiv v1 (cs.CR).[2] |
| August 11, 2026 (~6pm PT) | Independent researcher's reproduction of the attack suddenly stops working after initially succeeding.[1] |
| ~August 14, 2026 | Attack begins working again for the researcher three days later; password-recovery tests and blog write-up continue.[1] |
How it works
Providers no longer store chain-of-thought server-side; instead they return the reasoning to the client as encrypted, base64-encoded blocks that the client passes back with each subsequent request. The flaw is that these encrypted blocks are fully compatible and interchangeable across different sessions, users, and models within a single provider's ecosystem—likely because shared encryption keys are used across users, sessions, and models.[1][2]
By injecting an encrypted reasoning trace from one model into a weaker, less-safeguarded model from the same provider, the attacker forces the receiving model to decode and output the trace verbatim in plaintext—bypassing the need to jailbreak the more capable originating model. In OpenAI's case the trace is carried in a reasoning payload's encrypted_content field and requested via the include field reasoning.encrypted_content; a short jailbreak prompt asks the model to transcribe the attached 'thought' exactly.[1][2]
Because reasoning traces act as an internal monologue containing intermediate hypotheses, tool outputs, user data, and contextual secrets, decoding them can expose PII, credentials, hazardous information the visible output refused to provide, and can be abused for invisible prompt injection by embedding payloads inside encrypted blocks.[2]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| OpenAI reasoning models (e.g., GPT-5.6 'Sol' and 'Luna') | Encrypted client-side reasoning traces reproducibly recovered across sessions, accounts, and models by the independent researcher via chatgpt.com/backend-api/codex/responses. | Behavior was intermittently unavailable during testing (temporarily stopped, then resumed); no formal patch confirmed in the evidence.[1] |
| Anthropic, OpenAI, and Google reasoning APIs | Encrypted, client-held reasoning blocks demonstrated extractable across all three providers in the paper. | Responsible disclosure completed; cryptographic and system-level mitigations proposed by the authors.[2] |
Key takeaways
- Client-held encrypted reasoning traces are not confidential in practice: because encrypted blocks are interchangeable across sessions, users, and models, they can be replayed into a weaker model and decoded to plaintext.[1][2]
- Shared session logs are a real data-leak vector—315,320 scraped blocks yielded 367 PII items and 182 credentials—so encrypted reasoning blobs should be handled as sensitive data.[1][2]
- The attack succeeds without jailbreaking the strong originating model, and independent reproduction against OpenAI GPT-5.6 (including recovering a password across accounts) confirms real-world feasibility, though reliability varied over time.[1]
Defensive actions
- Do not treat encrypted reasoning blobs as harmless opaque data, and avoid publicly sharing session files that contain them.: Users may share session files containing encrypted reasoning blobs without realizing the underlying reasoning can be recovered, exposing PII and credentials such as API keys and passwords.[1][2]
- Adopt cryptographic and system-level mitigations to bind encrypted reasoning to a specific session, user, and model rather than using interchangeable/shared keys.: The vulnerability stems from encrypted blocks being fully compatible across sessions, users, and models; the paper proposes concrete cryptographic and system-level mitigations to secure client-side reasoning.[2]
- Avoid placing sensitive information (secrets, passwords) in prompts that can surface in the reasoning trace.: When a prompt involves sensitive information, that information may end up inside the reasoning trace and later be recovered from the encrypted blob.[1]