Encrypted reasoning traces cracked across OpenAI, Anthropic, Google
Researchers decoded 315K hidden thinking blocks from public agent logs, recovering 62 API keys and more — here's what leaked and how to guard your traces.
Copy markdown
Weaker models can read stronger models' hidden thoughts
The "encrypted" reasoning the big three hand back — OpenAI's encrypted reasoning items, Anthropic's encrypted thinking blocks, Google's thought signatures — turned out to be replayable across sessions and users, letting a cheap model decode a frontier model's hidden chain of thought. The opacity you were trusting was never bound to your session.
62 API keys and 33 passwords pulled from public traces
From 6,708 public agent trajectories the team decoded 315,320 thinking blocks and recovered 704 secrets: 62 API keys, 33 passwords, 24 access tokens, and 7 private keys. If you've ever shared an agent transcript, the "hidden" reasoning inside it may not have been hidden at all.
Four ways attackers abuse it
The paper maps four exploits: distill a frontier model from its leaked reasoning, mine private data out of published traces, recover harmful content sitting behind a sanitized answer, and smuggle prompt injections inside opaque reasoning blocks your app can't inspect.
What to change in your pipeline today
Strip reasoning and thinking blocks before you share or store traces, and never commit raw API transcripts even when the visible text looks clean. Anthropic now says drop thinking blocks when you switch models; Google reconciles thought compatibility server-side; OpenAI still permits reasoning replay for manual history management, so the burden falls on you.
The live attack is patched — your old logs aren't
Researchers say the main extraction attack is no longer reproducible as of August 2026, so the providers appear to have quietly tightened it. But anything you already published stays exposed: treat past transcripts as compromised and rotate any keys that ever rode along in them.