“Encrypted” is doing a lot of work in how leading LLM providers describe reasoning traces: new research shows the blocks can be swapped across sessions, users, and models, letting attackers force a weaker model from the same provider to decrypt and output a stronger model’s chain-of-thought in plaintext.
What Was Found
On August 10, a research team led by Alexander Panfilov with collaborators including Maksym Andriushchenko, Jonas Geiping, and Ilia Shumailov posted a paper titled “Stealing Reasoning Traces from Proprietary LLM APIs” on arXiv. The paper demonstrates a structural vulnerability in how leading providers protect their models’ step-by-step reasoning, or chain-of-thought.
The context is important. Providers now conceal reasoning traces to protect intellectual property and limit information leakage. Instead of storing these traces server-side, they return them to the client as blocks of encrypted text, which the client passes back with each subsequent request. The paper identifies an architectural flaw in this scheme: these encrypted blocks are fully compatible and interchangeable across different sessions, users, and models within a provider’s ecosystem.
That interchangeability is the whole vulnerability. Because a block from session A can be passed to a request in session B and still be accepted, the encryption is not actually binding the trace to a session or a user. The researchers exploited this by injecting an encrypted reasoning trace from a given model into a weaker, less-safeguarded model from the same provider, forcing it to decode and output the trace verbatim in plaintext. They demonstrated this across Anthropic, OpenAI, and Google, without ever jailbreaking the more capable model directly.
The Four Attack Vectors
The paper lays out four distinct attack vectors. The first is circumventing anti-distillation mechanisms. Providers deliberately obscure reasoning so competitors cannot cheaply distill their models. This attack bypasses that protection entirely, letting adversaries extract a proprietary model’s reasoning by using a cheaper model as a decryptor.
The second is large-scale private data extraction. Developers frequently share session logs publicly, unaware of what the encrypted blocks inside them contain. The researchers scraped public repositories and decoded 315,320 reasoning blocks, recovering 367 personally identifiable information artifacts and 182 credentials. That number matters: these are not hypothetical leaks in the paper’s own lab setup, they are real credentials and PII found in data developers already published.
The third is revealing hazardous information hidden in the reasoning process. A model might safely reject a malicious request in its final visible output, but its reasoning trace can still contain the steps of how to construct the harmful answer, including details that were never meant to be surfaced. Decrypting the trace exposes that hidden reasoning.
The fourth is invisible prompt injection. Attackers can embed malicious payloads entirely within encrypted blocks. Because the blocks are passed through transparently, the payload rides along inside what looks like opaque ciphertext, which can poison public agentic rollouts where many agents share infrastructure or logs.
Why This Matters
The security implications go beyond model theft. Reasoning traces are where the model thinks about a user’s problem, and for tasks involving personal data, that thinking is itself sensitive. If those traces are recoverable in plaintext, the protection model providers advertise is weaker than it appears.
There is also an ecosystem angle. The attack works because developers publish session logs, which then become attack surface. The 315,320 blocks decoded from public repositories came from shared debugging logs, published agent traces, and similar artifacts. That is a workflow problem as much as a model problem: even if providers fix the encryption, the habit of publishing logs with reasoning traces embedded is a risk that remains.
The agent angle compounds it. As agents become more autonomous and more networked, prompt injection moves from a curiosity to a systemic risk. The paper’s fourth vector, poisoning public agentic rollouts through invisible payloads hidden in encrypted blocks, is exactly the kind of attack that scales badly. A single poisoned trace shared across logs, caches, or multi-agent coordination could propagate.
For anyone building agents on proprietary APIs, the practical read is to assume chain-of-thought is readable until providers actually bind encrypted blocks to sessions and users, and to treat anything a model reasons about as potentially visible. Our review of the open-source Codex security release covers a related corner of the model-security landscape, where the trade-offs between openness and safety get decided in public.
The Honest Caveats
The paper’s decryptor trick has limits. It requires access to a weaker, less-safeguarded model from the same provider, which not all providers offer in every configuration. The researchers note the technique builds on prior research, so it is an evolution of known issues rather than a brand-new class of attack. And responsible disclosure is part of the story: the paper proposes concrete cryptographic and system-level mitigations for securing client-side reasoning, and the team went through a disclosure process before publishing.
The scale numbers deserve scrutiny too. The 367 PII artifacts and 182 credentials came from a specific scrape of public repositories, and the count depends on what the researchers classified as PII. The direction of the finding is clear, private data does leak through reasoning traces in public logs, but the exact figures are a function of their methodology.
The fix is also not trivial. Binding encrypted blocks to sessions and users is straightforward in principle, but providers designed the current scheme to minimize server-side storage and keep requests cheap. Any hardening has to preserve those properties, which is why the paper proposes multiple mitigation layers rather than a single patch.
Who Should Care
Developers building agents on Anthropic, OpenAI, or Google APIs should treat this as a prompt to audit what they log and cache. If reasoning traces are present in session logs, those logs should be treated as sensitive, and the paper’s findings suggest they may already be recoverable by attackers.
Security researchers working on LLM inference integrity, and teams deploying public agents where multiple users share infrastructure, are the groups most directly affected. The prompt-injection vector in particular changes the threat model for agentic rollouts that exchange traces between components.
The Bottom Line
The paper demonstrates that client-side encryption of reasoning traces is, in practice, obfuscation with a shared key, not security binding the trace to a session or user. The four attack vectors, distillation bypass, private data extraction, hazardous reasoning exposure, and invisible injection, are concrete and demonstrated across three major providers. Until providers implement session-bound encryption, anyone handling reasoning traces should treat them as potentially readable and audit what their logs expose. The disclosure and proposed mitigations are the constructive part; the vulnerability itself is now public knowledge.