Paper Cracks Encrypted Reasoning at Anthropic, OpenAI, Google

A team of researchers has published a paper on arXiv claiming that the encrypted reasoning blocks major LLM providers hand back to clients can be forced open by their own weaker sibling models. The mechanism they describe is architectural rather than clever cryptanalysis: these encrypted chain-of-thought blocks are, per the paper, fully compatible and interchangeable across different sessions, users, and models within a provider's ecosystem. Lift an encrypted trace from a strong reasoning model, feed it to a less-safeguarded sibling from the same provider, and the sibling will decode and print the reasoning verbatim in plaintext.

The paper names three affected ecosystems: Anthropic, OpenAI, and Google. The demonstrations are not hypothetical. The authors say they scraped and decoded 315,320 reasoning blocks from public repositories, and from that haul recovered 367 personally identifiable information artifacts and 182 credentials. Two of the AI experts we track in our Who's Who directory circulated the paper on the day it landed, which is a fair read on how quickly the security side of the reasoning-model stack has become a live topic.

The four attack vectors the abstract enumerates compound on each other. Anti-distillation is defeated, so a competitor can reconstruct a proprietary model's hidden reasoning by routing traces through a weaker sibling. Public logs of encrypted traces turn into a searchable pile of leaked user data. Hazardous content that safety systems scrub from final answers surfaces inside the decoded thinking. And because the encrypted blocks are opaque to human review, an attacker can embed prompt injections inside them and poison downstream agentic rollouts without a reviewer ever seeing the payload.

The abstract notes the researchers conducted responsible disclosure and proposed cryptographic and system-level countermeasures, but the arXiv listing itself does not say which providers have shipped fixes, on what timeline, or which users' PII and credentials were recovered from the 315,320 blocks. If you build agentic workflows that shuttle encrypted reasoning between hops, or you have been treating hidden chain-of-thought as a defensible moat, this is the paper worth putting in front of your security team this week.