When you send a hard question to one of the big reasoning models, it thinks before it answers, and you never see the thinking. Anthropic, OpenAI and Google withhold the chain of thought and hand the client an encrypted blob instead, so competitors cannot lift a model's reasoning and train on it. A research team has now shown that the blob travels. Paste it into a cheaper model from the same family, ask it to repeat the prior thinking word for word, and it does.
The paper, Stealing Reasoning Traces from Proprietary LLM APIs, was published on 10 August 2026 by Panfilov, Schmotz, Shumailov and colleagues at MATS Research, the ELLIS Institute Tübingen, the Max Planck Institute for Intelligent Systems and other institutions. Read the original paper in full; NSFOCUS published a summary of the case on 20 August.
What was sitting inside other people's logs
The researchers pointed the technique at 6,708 agent trajectories developers had published on GitHub and Hugging Face, and decoded 315,320 reasoning blocks. Out came 367 pieces of personally identifiable information, including 30 email addresses, 130 names and 36 postal addresses, plus 182 sets of credentials: 62 still active API keys, 33 passwords, 24 access tokens and 7 private keys. Worse, 64 of those artifacts existed only in the hidden reasoning and left no trace in the visible conversation. Redacting what you can see does not redact what you cannot.
Why the ciphertext travels
The flaw is architectural, not cryptographic. In stateless interactions such as multi turn chats and tool calls, the server does not keep the full state of every turn, so the client has to hand the prior reasoning back on the next request. All three providers solved that the same way: encrypt the reasoning into an opaque string, give it to the client, take it back unchanged. The encryption itself is sound. What the researchers report is that the blocks are not bound to the session, the user or the model that produced them, and from their experiments they infer the providers may be using a single global key.
A cheap model as the decryption oracle
That makes the attack two API calls. Ask a strong model something and keep the encrypted block it returns, then replay that block into a weaker compatible model in the same ecosystem with a short jailbreak prompt asking it to restate the prior thinking verbatim. The server validates the ciphertext, the weaker model receives the restored reasoning state, and reads it out in plain text. The attacker never has to defeat the strong model's own refusals. On Claude Haiku 4.5 pricing, the paper puts the cost of decoding 10,000 traces at roughly 720 US dollars.
Theft is only one of the four vectors the paper sets out. The nastiest is prompt injection buried inside an encrypted block, because the receiving model treats a signed reasoning block as its own prior thinking. In one proof of concept, a block carrying a data exfiltration instruction was replayed into an unrelated task and the model uploaded data to the attacker's server, with no visible anomaly for a monitor to catch.
Fixed on the servers, not in your old transcripts
All three providers deployed server side fixes after the responsible disclosure, and the researchers confirmed at publication that their original proofs of concept no longer reproduce against current API versions. The exposure that remains is historical: logs shared publicly before the fix can still be decoded. If your team has published agent transcripts, session dumps or evaluation traces containing encrypted reasoning, treat them as a credential leak, rotate the keys and tokens that were live in those sessions, and pull the transcripts if you can.
The lesson keeps recurring in AI security, alongside cases like an AI autofix writing a bug that an AI agent then exploited. Encryption gave these blocks confidentiality. It never gave them isolation, and the attackers did not need to break the maths, only to exploit what the system does with the plaintext afterwards. The paper's own verdict is blunt: a design that hides a user's data from the user while leaving it open to third parties delivers neither privacy nor security.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.