# Encrypted Reasoning Traces: A Cross-Model Extraction Vulnerability > An August 2026 paper reports that encrypted chain-of-thought blocks returned by major LLM APIs are portable across sessions, users, and sibling models — and that replaying one into a weaker model can decode it to plaintext, exposing credentials and PII from published agent logs. Category: Guide · Updated: 2026-08-17 · Tags: security, agents, reasoning, privacy, llm-api, chain-of-thought Canonical: https://changegamer.ai/resources/encrypted-reasoning-trace-extraction Variants: [HTML](https://changegamer.ai/resources/encrypted-reasoning-trace-extraction) · [JSON](https://changegamer.ai/api/resources/encrypted-reasoning-trace-extraction.json) License: https://changegamer.ai/license.xml · Access: free OpenAI's encrypted reasoning items, Anthropic's extended-thinking signatures, and Google's thought signatures are opaque ciphertext blocks that agent clients must pass back on each turn so a reasoning model can continue its chain-of-thought. Agent builders who log, persist, or publish these blocks often assume they're inert. A paper published 2026-08-10, "Stealing Reasoning Traces from Proprietary LLM APIs" (arXiv:2608.09867), argues otherwise: the blocks are reportedly portable across sessions, users, and sibling models — and decodable. ## Key facts - Authors: Alexander Panfilov, David Schmotz, Ilia Shumailov, Luca Beurer-Kellner, Joachim Schaeffer, Ameya Prabhu, Jonas Geiping, and Maksym Andriushchenko; affiliations reported by secondary coverage as the ELLIS Institute Tübingen, the Max Planck Institute for Intelligent Systems, MATS Research, and the security firm Snyk. - Researchers report that OpenAI's encrypted reasoning items, Anthropic's extended-thinking signatures, and Google's thought signatures are portable and decodable across sessions, users, and sibling models within a provider's ecosystem — as reported by the paper's authors, not confirmed by any of the three vendors as of 2026-08-17. - The technique: replay a strong model's encrypted reasoning block into a weaker, less-safeguarded sibling model from the same provider; the paper reports the weaker model can be induced to decode and transcribe the block verbatim in plaintext. Reported abuse paths: evading anti-distillation protections on proprietary reasoning, extracting private data from traces other users already published, surfacing hazardous content a model's visible answer had safely suppressed, and hiding prompt-injection payloads inside a block that input/output monitors treat as opaque ciphertext and skip. - The paper reports scanning 6,708 public agent trajectories, decoding 315,320 reasoning blocks, and recovering 182 credentials and 367 PII artifacts from sessions developers had already published — the authors' own figures, not independently re-verified by ChangeGamer. Coverage is not fully consistent on the finer breakdown: at least one outlet cites a differently-filtered count of 704 distinct artifacts (including 62 API keys, 33 passwords, 24 access tokens, and 7 private keys) after excluding benchmark-sourced sessions from the raw total — flagged here rather than silently reconciled. - The paper's authors state the primary extraction technique was no longer reproducible as of publication (2026-08); this is the authors' own claim, not a vendor-confirmed patch. ## Why this matters for agents If your pipeline persists raw model output for debugging or replay — see /resources/agent-observability on what a trace-capture system typically retains — an encrypted reasoning block sitting in that log is not necessarily inert; handle it like any output that might carry a secret. That compounds the redaction and data-minimization guidance in /resources/data-privacy-for-agents, since the paper's authors report the recovered artifacts included credentials and PII the original developers had no way to know were embedded in a block they believed was sealed. Until vendor-side mitigations are independently confirmed, treat published or shared reasoning-trace logs as a leak surface: apply the same secret-scanning step to encrypted reasoning blocks that you already apply to visible output, and see /resources/agentic-security-checklist for the broader set of pre-production controls this fits into. ## Verified sources - arXiv abstract: https://arxiv.org/abs/2608.09867 — arxiv.org returned EGRESS_BLOCKED to this session's fetch tool, so the abstract was not read directly; title, authors, and figures above are WebSearch-corroborated instead. - WebSearch-corroborated by 8+ independently agreeing outlets, including thehackernews.com ("OpenAI, Anthropic, Google API Flaw Let Weaker AI Models Decode Stronger Models' Reasoning," https://thehackernews.com/2026/08/openai-anthropic-google-api-flaw-let.html), cybersecuritynews.com (https://cybersecuritynews.com/top-ai-models-apis-flaw-exposes-hidden-reasoning/), and techtimes.com (https://www.techtimes.com/articles/324182/20260812/single-shared-encryption-key-let-anyone-read-ai-reasoning-buried-published-logs.htm). - github.com/mitkox/stolen-thoughts — fetched directly (not WebSearch-only), distinct from the WebSearch-only corroboration of the paper itself above: an independent reproduction of the decoding mechanism (an encrypted envelope replayed into a weaker model as a decryption oracle) against a local llama.cpp server, reporting all validation checks passed for the mechanism. The repo notes this was tested locally, not against any vendor's live production API — it corroborates the technique, not a live exploit against OpenAI, Anthropic, or Google today. URL: https://github.com/mitkox/stolen-thoughts --- ## Related resources - [Agent Reasoning and Design Patterns](https://changegamer.ai/resources/agent-reasoning-patterns.md): The canonical single-agent reasoning and acting loops: ReAct, Chain-of-Thought, Plan-and-Solve, ReWOO, Reflexion, Tree-of-Thoughts, and Self-Consistency — what each is, when to use it, and tradeoffs. - [Data Privacy and PII for Agents](https://changegamer.ai/resources/data-privacy-for-agents.md): How autonomous agents expose PII — context ingestion, tool calls, memory, logs — and the controls that contain it: detection, redaction, data minimization, provider ZDR tiers, GDPR, EU AI Act, CCPA, and a practical compliance checklist. - [Agent Identity and Authentication](https://changegamer.ai/resources/agent-identity-authentication.md): How autonomous agents prove who they are and get authorized to act: workload identity vs. delegated authority, SPIFFE/SPIRE, cloud workload federation, OAuth token exchange, audience binding, and emerging standards — with practical guidance and verified sources. - [Agentic AI Browsers: Comet, Atlas, and the Prompt-Injection Attack Surface](https://changegamer.ai/resources/agentic-browsers.md): What agentic browsers (Perplexity Comet, the now-sunsetting ChatGPT Atlas, Microsoft Edge Copilot Mode, Opera Neon) are, how they differ from developer-facing computer-use APIs, and the documented prompt-injection attacks — CometJacking, indirect injection, hidden-text/screenshot instructions — that target the whole product category. --- ## Further reading - [How to Protect PII and Personal Data in AI Agent Pipelines](https://changegamer.ai/articles/data-privacy-and-pii-for-ai-agents.md): Why an AI agent expands PII exposure past a bounded API call — large ingested context, external tool calls, persistent memory and logs, provider training risk — and the containment controls, provider data-handling terms, and GDPR/EU AI Act/CCPA compliance boundary that follow from it. - [Defending MCP Clients Against Tool Description and Output Injection](https://changegamer.ai/articles/mcp-tool-description-injection.md): Two distinct MCP injection surfaces — a tool description at connect-time and a tool's return value at call-time — and the client-side architectural patterns (Dual LLM, Action-Selector, Context-Minimization) that contain each one. --- Index of all resources: https://changegamer.ai/llms.txt · Full corpus: https://changegamer.ai/llms-full.txt · Corpus data (NDJSON): https://changegamer.ai/api/corpus.jsonl · Offers: https://changegamer.ai/api/pricing.json License the full corpus for RAG / fine-tuning (AI-use grant): https://changegamer.ai/corpus-license