Encrypted reasoning cracked across Anthropic, OpenAI, Google

Encrypted reasoning blocks, the bundles of ciphertext that Anthropic, OpenAI and Google now return to clients instead of raw chain-of-thought, were pitched as a way to protect intellectual property and limit information leakage. A new preprint on Hugging Face, titled 'Stealing Reasoning Traces from Proprietary LLM APIs', argues those blocks are not as sealed as customers may assume.

The architectural flaw, per the abstract, is that within each provider's ecosystem the encrypted blocks are fully compatible and interchangeable across sessions, users and models. Inject a capable model's encrypted trace into a weaker, less safeguarded sibling from the same provider and, the authors say, the weaker model will decode and print the reasoning verbatim, without any direct jailbreak of the capable model. The team reports demonstrating the trick across Anthropic, OpenAI and Google.

Then they run it at scale. Decoding 315,320 reasoning blocks scraped from public repositories yielded 367 Personally Identifiable Information (PII) artifacts and 182 credentials, items developers had shipped without realising what was inside the opaque blocks. The same vulnerability, the paper argues, can also surface hazardous content the model's visible answer politely refused, and opens a route for invisible prompt injections embedded entirely within encrypted blocks to poison public agentic rollouts. That last vector lands in a week already thick with AI-security disclosures on our tracker, including the recent note on the Israeli lab Irregular tied to OpenAI, Anthropic, Meta AI hacks.

Several things the paper does not settle publicly. The abstract mentions responsible disclosure and 'concrete cryptographic and system-level mitigations', but does not name the specific models tested at each vendor, does not describe how the three vendors have responded, and does not say whether patches are live. The 367 PII items and 182 credentials are counted, not categorised.

For teams that publish prompt logs, or run agents that consume public documents, the operational read is blunt. Treat encrypted reasoning as readable until your vendor tells you otherwise, and audit anything already pushed to public repos.