Encrypted Reasoning Was Only Semi-Hidden

OpenAI, Anthropic and Google all concealed the chain-of-thought the same way: encrypt it, hand it back to the client, take it in again on the next call. The cryptography held. The binding did not — the encrypted blocks proved interchangeable across sessions, across users, and across models in the same family. So an attacker never had to break the strong model at all. Capture its ciphertext, hand that to a cheaper sibling whose refusals are thinner, ask the sibling to read aloud — and the provider decrypts on request. Eight researchers then pointed the technique at logs developers had already published, and read out the secrets their authors never knew were in there.

By the Numbers one sweep of public logs

315,320reasoning blocks decoded from public repositories
6,708public agent trajectories swept for them
704privacy artifacts from genuine user sessions
64of those appear nowhere in the visible chat

How the Attack Runs the strong model is never touched

01Querya strong model
02Captureits ciphertext
03Replayinto a sibling
04Decryptprovider obliges
05Transcribeweak refusals
06Plaintextverbatim trace

What Follows 起 · 承 · 轉 · 合

Beat	Page	What it covers
起 Setup	2	Why the reasoning went dark, and why the envelope was pushed to the client.
承 Development	2	Three degrees of compatibility, the per-provider carriers, and how the finding matured.
轉 Pivot	3	Four distinct abuses of one architectural flaw.
合 Resolution	3	What the vendors fixed, and what a fix can no longer reach.

Bottom line

The cryptography was never the weak part. Handing someone a locked box, plus a key-holder who opens it for anyone who asks politely, is not confidentiality — it is obfuscation with extra steps. The AEAD was sound; the binding was simply absent.

Reframe

Safety was enforced per model while keys were shared per family. That mismatch is the entire vulnerability, and it will recur wherever capability tiers share infrastructure.

起承 · Context · Content 1 / 2

起 — Why the Thinking Went Dark two motives, one shortcut

Motive · IP and leakage
Hide the Chain-of-Thought
the stated rationale
- Raw reasoning is trainable material — concealing it slows distillation by competitors.
- A trace leaks considerably more than the answer it produced.
- All three vendors converged on the same decision, independently.
- None of them documents the cryptographic scheme it chose.
- As of July 2026 the design was still undescribed in public.
Shortcut · statelessness
Give It to the Client
encrypted, not stored
- Server-side storage costs state; ciphertext in the client's hands costs nothing.
- An AEAD envelope — header, nonce, authentication tag, ciphertext.
- The client returns it with every subsequent call, unread.
- The signature is hashed into the MAC as associated data.
- Nothing in the envelope names a session, a user, or a model.

承 — Three Degrees of Compatibility increasingly permissive

The taxonomy is the paper's real contribution. Blocks replay within and across sessions; then across users, so one account can feed in a trace captured from another's; then across models in the same family. The third degree is the lever. The strong model is never jailbroken — it is merely quoted to a cheaper sibling whose refusal training is thinner, and that sibling reads the trace out verbatim. Because no vendor documents the scheme, the authors infer from behaviour that a single global key is in use. Their exact words are appear to be, and that hedge belongs in every retelling of this finding.

1 keyper provider — inferred from behaviour, never disclosed
cross-modelthe degree that turns replay into extraction

Provider	Client-side carrier	As the paper describes it
OpenAI	signature	Encrypted reasoning items returned for manual replay under stateless history management.
Anthropic	thinkingSignature	Thinking blocks carrying an opaque, base64-encoded signature alongside a summary.
Google	thoughtSignature	Thought signatures, as documented for the Gemini API.

29 May 2026Matthew Green establishes replay across sessions, accounts and models, plus a timing side channel — but cannot reliably recover plaintext, and says so plainly.
Early Jul 2026Panfilov et al. disclose reliable, scalable extraction to all three providers.
10 Aug 2026Paper published; 315,320 blocks already decoded out of public repositories.
11 Aug 2026Green updates his May post to point at the result that finished the job he had started.
Aug 2026Attacks no longer reproduce. Receipt was acknowledged — but no public vendor statement, and no CVE.

轉合 · Pivot & Resolution · Content 2 / 2

轉 — Four Abuses of One Flaw one lever · four outcomes

Vector	What it yields	Why it stings
Distillation	the proprietary reasoning, verbatim, demonstrated across all three vendors	it defeats the exact concealment that the whole design existed to provide
Data extraction	62 API keys, 33 passwords, 24 access tokens and 7 private keys, from real sessions	harvested from logs their owners chose to publish, believing them already sanitised
Hidden hazards	content that the model's own visible answer had already refused to give	a refusal at the output layer is not a refusal inside the reasoning that preceded it
Invisible injection	a payload living entirely inside the opaque block, carried by an innocent trace	no reader of the transcript can see it — a shared trace becomes a delivery vehicle

What the Sweep Actually Found public repositories, Aug 2026

1,028decoded blocks carrying a privacy violation
0.3%of all blocks decoded — rare, not harmless
328sessions affected, or 4.9% of trajectories
912artifacts once benchmark traces are counted too

One number outweighs the rest. Of the 704 artifacts recovered from genuine user sessions, 64 appear nowhere in the visible chat history — the secret existed only inside the reasoning. Anyone who diligently scrubbed their transcript before publishing it would have missed every one of those, because there was nothing in the readable part left to scrub. That is what makes this different from an ordinary leaked-credentials story: the standard remedy, read it before you publish it, does not work on a field you cannot read. The benchmark traces were counted separately for a mundane reason the authors were careful to give — rollouts such as ClawBench hand the model a complete synthetic persona to reason over, which would otherwise inflate every personal-data count in the study.

64artifacts that sanitising the visible text could never have caught
benchmarkscounted apart — synthetic personas would inflate the totals

合 — Where It Lands fixed forward, not backward

Bind the envelope — carry user and conversation identifiers inside the AEAD payload so a replayed block is rejected outright.
Isolate across models — refuse any envelope minted by a model version other than the one being queried.
Store server-side — return only an opaque random identifier; the answer the design set out to avoid.
Add revocation — track issued signatures so a compromised trace can be invalidated.
Strip before publishing — remove every opaque reasoning field from any transcript that leaves your machine.
Rotate what already left — a server-side fix stops new reads, never old leaks.
Train the refusal — teach models to reject prompts that ask them to transcribe hidden reasoning; note this defends at the layer that already failed once.
Treat opaque fields as content — a field you cannot read is unsanitisable, not empty, and should never be assumed harmless.

What the fix reached

All three providers closed the door within weeks, and the proofs of concept no longer run. But 315,320 blocks are already public, and every credential inside them is already spent. A fix that arrives after publication un-publishes nothing — the only remaining remedy is rotation, by people who do not yet know they need it.

The lasting change

Shared agent traces are now a supply-chain surface, and the authors' own structural limit stands: unless the model is fully robust against extraction prompts, encrypted reasoning can never be more than semi-hidden. Every vendor reached for the same shape independently, and every one of them forgot that the client is not the only party who can hand that state back.