A research team from universities and security firms has shown how the encrypted reasoning traces of OpenAI, Anthropic, and Google can be read out. The blocks work across all models from a given provider and can be injected into a weaker system that then outputs them in plain text. From publicly available datasets, the researchers already recovered 367 personal data points and 182 access credentials.
Weaker Model Leaks Another Model’s Reasoning Blocks
Major AI providers hide the internal reasoning steps of their models by returning them as encrypted text blocks, which client programs pass back with every follow-up request. The study Stealing Reasoning Traces from Proprietary LLM APIs, published on arXiv on August 10, 2026, shows that these blocks use one shared key per model family rather than being bound to a single session, user, or specific model. An encrypted block from a powerful model can therefore be slipped into a weaker, less-safeguarded model from the same provider, which decrypts the content and outputs it verbatim, without ever jailbreaking the strong model directly. According to the team around Maksym Andriushchenko, models from Anthropic, OpenAI, and Google are equally affected. The 116-page paper lists Alexander Panfilov, David Schmotz, and Jonas Geiping among its authors, based at the University of Tübingen, the Max Planck Institute for Intelligent Systems, the ELLIS Institute Tübingen, and the security firms MATS Research and Snyk. The method also enables distillation attacks: anyone who extracts a strong model’s raw reasoning steps can use them to train their own, cheaper model, exactly the practice providers originally encrypted their reasoning output to prevent. The blocks can also expose hazardous intermediate reasoning even when the final answer visibly refuses a request.
Public Repositories Hold Hundreds of Access Credentials
The team analyzed 315,320 encrypted reasoning blocks that developers had unknowingly left in public code repositories and datasets. After decryption, they found 367 personal data records and 182 access credentials inside them – the exact composition of these findings is independently unverified, since the study does not publish the affected repositories for privacy reasons. Reports indicate the credentials include at least 62 API keys, 33 passwords, and 30 private email addresses. Companies building their own AI agents on top of these APIs are especially exposed: many agent frameworks cache reasoning blocks between conversation turns to preserve context across multiple tool calls. If such intermediate states end up in a public repository or a training dataset for an in-house model, the secrets encrypted inside travel along unchecked. According to the researchers, a single forgotten debug log, where an agent quoted its own environment variables or access tokens while testing, is often enough. Anyone who stores or forwards reasoning blocks from API responses unknowingly distributes sensitive information that was never visible in plain text.
Security Community Split on How to Classify the Flaw
Not everyone in the field agrees this counts as a new vulnerability. In the discussion on Hacker News, one commenter argues that if the same block decrypts across sessions and users, it isn’t real encryption at all but obfuscation with a shared key, a deployment problem rather than a research curiosity. The research team itself notes that independent security researchers had already documented similar weaknesses in reusable encrypted reasoning blocks back in May and June 2026, without any of the three providers publishing architectural fixes since. The flaw joins a string of cross-vendor AI security findings from the past month: earlier in August, security firm Zenity disclosed a zero-click flaw in five AI browsers from Anthropic, Google, OpenAI, Perplexity, and Microsoft.
Whether OpenAI, Anthropic, and Google will eventually bind encryption to individual sessions or users, or switch to server-side checksums, remains open – both fixes proposed by the research team would fundamentally change the current architecture. Until one of the three companies confirms a correction, every publicly stored reasoning block remains a potential data leak for its own codebase.
