Encrypted LLM reasoning traces are decodable — scrub your logs
A shared per-family key let weak models transcribe a stronger one's hidden reasoning; 182 secrets sat in 315K public traces. APIs patched, old logs aren't.
Copy markdown
How the replay attack worked
Providers returned encrypted chain-of-thought blocks that turned out to be interchangeable across sessions, users, and models in one family. Feed a frontier model's block into a jailbroken weaker sibling — Claude Haiku 4.5 was the demo — and it transcribes the hidden reasoning back to you verbatim.
182 secrets pulled from public logs
Researchers decoded 315,320 reasoning blocks scraped from public repos and gists, recovering 182 credentials and 367 PII artifacts. A single ~7,000-trace sample held 62 unique API keys, plus dozens of passwords and emails — all sitting in "encrypted" fields people assumed were opaque.
The API side is already patched
OpenAI, Anthropic, and Google acknowledged the report and the extraction attack no longer reproduces; Anthropic's fix removed the assistant-turn-prefix feature in its Claude 4.6 models. The catch: the mitigation stops new attacks, it does nothing about traces you've already published.
Scrub your logs before you share them
Strip reasoning and opaque-field blobs before you post an agent transcript, and don't commit raw API logs even when the visible text looks clean — the base64 reasoning payload is where the secrets live, not the answer.
Then rotate — don't just delete
Rotate every credential a leaked session could have touched, not only the keys you can see in plaintext, and grep your repos and gists for base64 blobs in reasoning fields while you're at it.