Shared agent logs leak API keys through 'encrypted' reasoning blocks
Providers hand back reasoning as portable blobs any model can replay, so a weak model decrypts a strong one's trace. Now patched — but purge your old logs.
Copy markdown
The 'encrypted' reasoning isn't bound to you
Providers return chain-of-thought as opaque encrypted blocks you replay on each call — but the paper shows they're interchangeable across sessions, users and models. Feed a strong model's block to a weaker, less-guarded sibling and it transcribes the hidden reasoning in plaintext. Demonstrated against Claude, GPT and Gemini.
315,320 traces cracked from public repos
Scanning 6,708 public agent trajectories on GitHub and Hugging Face, the team decoded 315,320 reasoning blocks and pulled 62 API keys, 33 passwords, 24 access tokens and 7 private keys from real user sessions. If you've ever pushed an agent transcript, treat those secrets as exposed.
Data theft is only one of four abuses
The same replay trick clones a frontier model's reasoning to dodge anti-distillation guards, surfaces hazardous content a model tried to hide in its thinking, and smuggles invisible prompt injections inside 'encrypted' payloads your app blindly trusts.
Strip thinking blocks before you share
Sanitizing the visible text isn't enough — the secrets live in the encrypted trace. Drop reasoning and thinking blocks before committing or sharing any log, and Anthropic already advises removing them when you switch models. Audit old trace dumps and debugging gists this weekend.
Elsewhere: Claude Code stops printing MCP secrets
v2.1.234 (Aug 17) stops MCP diagnostics from echoing resolved secrets — it now shows only the ${VAR} name and the server origin. Update if you run MCP servers with tokens in the environment.