Preprint finds flaw that let researchers decode encrypted chain-of-thought blobs from major LLM APIs

A newly posted arXiv preprint claims a design flaw in the “encrypted reasoning” systems used by major AI companies allowed researchers to decode hidden chain-of-thought traces across model families, including systems from Anthropic, OpenAI and Google.

Why that matters goes beyond a debate over whether AI companies should expose internal reasoning at all. The paper says the same flaw let researchers recover personally identifiable information and credentials from publicly shared agent logs, raising privacy and security concerns for developers and platform operators that handle those logs.

The paper, “Stealing Reasoning Traces from Proprietary LLM APIs,” was submitted Aug. 10 and published as arXiv:2608.09867. Its authors are Alexander Panfilov, David Schmotz, Ilia Shumailov, Luca Beurer-Kellner, Joachim Schaeffer, Ameya Prabhu, Jonas Geiping and Maksym Andriushchenko. Affiliations listed include MATS Research, the ELLIS Institute Tübingen, the Max Planck Institute for Intelligent Systems, the Tübingen AI Center, AI Security Company, Snyk and the University of Tübingen.

As the abstract puts it, “Leading large language model providers now conceal their models' step-by-step reasoning, or chain-of-thought, to protect intellectual property and limit information leakage.”

In plain terms, the researchers say some providers do not keep all hidden reasoning entirely on their own servers. Instead, they send it back to the client as an opaque encrypted field, which the application must return unchanged in later turns of a conversation. Provider documentation describes that general behavior, and the paper argues the approach reduces server-side storage but creates a replay problem.

According to the preprint, those encrypted blocks were compatible across sessions, users and models within a provider’s ecosystem. The team says it exploited that compatibility by taking an encrypted reasoning block from a stronger model and replaying it into a weaker sibling model from the same provider. That weaker model then returned the hidden reasoning in plaintext, effectively acting as a decryption oracle.

The paper says the attack worked across providers including Anthropic, OpenAI and Google during a testing window in early July 2026. Those results are bounded to the specific API versions and reasoning models available at that time, and the findings have not been independently confirmed in this article.

The authors group the risks into four categories: extracting proprietary reasoning traces and bypassing anti-distillation protections; extracting private data from publicly posted session logs; revealing hazardous information that may appear in hidden reasoning even when the visible answer refuses a request; and embedding invisible prompt injections inside encrypted blocks.

On the privacy side, the paper reports that the team scraped 6,708 publicly available agent or session trajectories from GitHub and Hugging Face, then extracted and decoded 315,320 encrypted reasoning blocks. From those decoded blocks, the authors say they recovered 367 distinct PII artifacts and 182 credentials, including API keys, passwords and personal email addresses. The paper says the recovered secrets were handled under an isolation protocol and later deleted after analysis.

That makes the core claim more than an intellectual-property story about model makers trying to protect proprietary reasoning. If developers are publishing raw logs that include opaque reasoning blobs, the paper suggests those blobs may contain recoverable secrets and personal data, creating security and potential compliance risks.

The paper also places the finding in a narrower technical context than broader public arguments over chain-of-thought disclosure. Earlier work and public commentary, including a May 2026 blog post by cryptographer Matthew Green, had already raised concerns about encrypted reasoning blobs. The new claim here is more specific: cross-model replay within a provider’s lineup can turn a weaker model into a decryption tool.

The authors say they disclosed the issue before publication to the affected model API providers as well as Microsoft and Hugging Face. In the paper’s disclosure section, they write: “All model providers acknowledged the receipt of our report and subsequently we were unable to launch the same attacks.”

As of Aug. 11, searches did not locate a public press release or blog post from OpenAI, Anthropic or Google explicitly addressing this specific paper. That search result does not establish that the companies have not responded privately or changed systems since the researchers’ tests.

The preprint recommends non-replayable cryptographic envelopes, per-session keys and more server-side state management or attestation. It also urges developers not to publish raw logs containing opaque reasoning fields.

For anyone building with agentic AI systems, that may be the most practical takeaway: a blob that looks unreadable in a shared log may not be safely opaque at all.