Research · curated 12 Aug 2026
Stealing Reasoning Traces from Proprietary LLM APIs
First reported arxiv.org
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
The reasoning-trace decryption jailbreak lets attackers exfiltrate credentials and PII from shared session logs and hide prompt injections inside encrypted blocks, undermining a security mechanism deployed across the three largest LLM providers.
Researchers in the paper "Stealing Reasoning Traces from Proprietary LLM APIs" (arXiv:2608.09867) show that encrypted chain-of-thought reasoning blocks returned by OpenAI, Anthropic, and Google reasoning APIs are interchangeable across sessions, users, and models within a provider ecosystem. By injecting a stronger model's encrypted reasoning trace into a weaker, less-safeguarded model in the same family, they force it to decode the trace verbatim, enabling four attack vectors: circumventing anti-distillation protections, extracting private data (recovering 367 PII artifacts and 182 credentials from 315,320 decoded blocks scraped from public repos), revealing hazardous content hidden behind safe answers, and embedding invisible prompt injections in opaque blocks.