Encrypted reasoning traces cracked across Claude, GPT and Gemini
A shared key let researchers replay one model's hidden chain-of-thought into a weaker sibling — and scrape 182 credentials from traces already in public repos.
Copy markdown
Same key, every model in the family
Providers hand you reasoning as an encrypted blob you pass back each turn. Researchers found those blobs are interchangeable across sessions, users, and models — one family, one key — so a trace captured on another account replays cleanly on yours.
The attack: let the weak sibling read the strong one's mind
Feed a frontier model's encrypted trace to a smaller, less-guarded sibling and prompt it to transcribe the reasoning verbatim. It decrypts and spills the plaintext chain-of-thought — a working jailbreak built on a prefill feature the labs have since removed.
182 credentials were already sitting in public repos
The team scraped 315,320 reasoning blocks from public GitHub repos and logs, then pulled out 367 PII artifacts and 182 live credentials. If your app persists these blobs, treat them as plaintext, not ciphertext.
What to do before your vendor fully patches
All three labs acknowledged the report and the specific replay attack no longer fires, but audit anything already pushed public and stop logging encrypted reasoning. Related trace-reconstruction attacks are harder to fix and remain open.
Elsewhere: Vercel Connect wires up 100+ connectors from the terminal
`vercel connect create` now sets up any of 100+ preset connectors straight from the CLI, no dashboard trip, and Connect added token-lifecycle observability with log-drain forwarding.