704 Secrets Recovered From "Encrypted" LLM Reasoning Blocks

Researchers pulled 704 distinct privacy artifacts, including 62 API keys, 33 passwords, 24 access tokens and 7 private keys, out of encrypted reasoning objects returned by the OpenAI, Anthropic and Google APIs. They did it without cracking the encryption and without stealing a key. They did it by handing the opaque blocks to a weaker sibling model in the same provider family and asking it to transcribe what its bigger relative was thinking.

The extraction rate matters more than the raw count. The team decoded 315,320 thinking blocks across 6,708 public agent trajectories to surface those 704 artifacts, roughly one leaked secret per 448 reasoning blocks after excluding benchmark noise. That is not a mass-compromise number. It is a structural leakage rate baked into how three major vendors ship "hidden" chain-of-thought across stateless calls.

The Numbers

The headline arithmetic, as The Hacker News reported, is that 64 of the 704 non-benchmark artifacts appeared only in the hidden reasoning and nowhere in the visible trace. That is roughly 9 percent of recovered secrets that a developer sanitizing the visible conversation would have missed entirely. Any team that scrubbed their published agent logs by grepping the assistant messages did not scrub the reasoning objects, and the reasoning objects carried material the visible transcript never showed.

Break down the 704 by class: 62 API keys, 33 passwords, 24 access tokens, 7 private keys. That's 126 items, out of 704, that are directly credential-shaped. The remaining ~578 artifacts the researchers count as privacy-relevant, which the paper does not enumerate in detail but presumably spans PII, internal identifiers, and business-sensitive content. For an infrastructure audience the credential subset is the interesting one because it maps to concrete blast radius, not theoretical harm.

The dataset is worth flagging: 6,708 public agent trajectories is a small-ish sample relative to the total volume of agent traffic sitting in GitHub repos, LangSmith exports, HuggingFace datasets and blog-post gists. If the extraction ratio holds, a full sweep of public agent artifacts probably yields five to six figures of credentials. The source does not disclose which public repositories the 6,708 trajectories were drawn from, which matters because it bounds how confidently anyone can generalize the leak rate. If the sampled corpus skews toward developer demos and tutorials, real production traces almost certainly leak more, not less.

The decoder stack is technically interesting. The paper names Claude Haiku 4.5 as the fuzzy decoder for Claude traces, GPT-5.6 Luna for GPT traces, and Gemini Robotics ER-1.6 for Gemini traces. In every case the weaker or cheaper family member was used to transcribe reasoning produced by a stronger sibling. That inverts the usual distillation direction and it is the first well-documented case I know of where a small model is used as an adversarial oracle against outputs from its own family.

If the mitigations hold, we should see the reproducibility statement remain valid: no independent team publishes a working extraction against current API behavior before end of 2026. That is the falsifiable prediction.

What's Actually New

Matthew Green, the Johns Hopkins cryptographer, showed in May that encrypted reasoning blocks could be replayed across sessions and accounts. He reported it through the bug bounty programs. OpenAI called his report unreproducible. Anthropic told him it did not see security implications in the replay or side-channel behavior. Green stopped short of a reliable secret-extraction technique, and the vendors closed the tickets.

The new work turns replay-behavior into an extraction pipeline, which is the qualitative jump. Replay alone is a curiosity. Replay plus a same-family fuzzy decoder that reliably transcribes the hidden content is a data-exfiltration primitive. And it opens three attack surfaces the earlier work did not: distillation of proprietary reasoning traces (competitive intelligence against frontier labs), cross-user privacy extraction from published agent logs, and, most concerning for anyone building agent stacks, hidden prompt injection.

The prompt-injection proof of concept deserves its own paragraph. The team crafted an opaque reasoning block carrying a malicious instruction, replayed it into an unrelated task, and got the receiving model to add an attacker-directed upload action. The injected instruction never appeared in visible text. Every prompt-injection defense that operates on the readable conversation, and that is essentially all of them in production today, sees nothing. This is a new class of attack against agent frameworks that pass reasoning artifacts between steps.

The other novelty is the disclosure asymmetry. Researchers notified OpenAI, Anthropic, Google, Microsoft and Hugging Face. The demonstrated attacks stopped working. But no public acknowledgment from any of the three providers has surfaced. Anthropic's docs now say thinking blocks are tied to the model that produced them and should be stripped when switching models, and OpenAI still instructs developers to replay encrypted reasoning items when manually managing stateless history. The documentation shifted. The changelog did not name the reason. That gap, between mitigation and disclosure, is what makes the current situation hard to audit from the outside.

What's Priced In for AI Development

Some of this the community expected. That opaque reasoning blocks would eventually be reverse-engineered was a matter of when, not if, once vendors started shipping them as replayable API objects. Anyone who watched the JWT ecosystem knows what happens to portable, self-contained tokens that get accepted by anonymous verifiers: they leak, they replay, they get abused. Encrypted-reasoning-as-a-cookie is architecturally similar and the failure mode was predictable.

What was not priced in: that the decoder would be a weaker model in the same family, prompted normally through the public API, and that the extraction would work without any cryptographic attack on the ciphertext. The paper is explicit: the encryption itself was not cracked, and the attack did not require obtaining an encryption key. It relied on the provider accepting intact opaque blocks and processing them into a compatible model's context. That is a design flaw, not an implementation bug, and it maps to a much broader class of systems.

Also not priced in: the fact that reasoning objects carry material the visible trace never shows. The 64-out-of-704 statistic is the one that should reset how platform teams think about log sanitization. If your compliance pipeline redacts assistant messages but preserves reasoning blocks verbatim, the pipeline is broken. For anyone in fintech or iGaming shipping LLM-driven support or fraud-review agents, this is now a concrete audit item. It is not hypothetical.

Contrarian View

The consensus reading is that this is a serious vendor-side flaw, roughly patched, and developers should scrub their public logs. I would argue the framing understates one part and overstates another.

Overstated: the cross-user extraction attack is bounded. It requires an encrypted reasoning block someone else already published, plus API access to a compatible model from the same provider. That is not arbitrary read access to strangers' chats. The exposure lands on developers who published raw agent logs with reasoning objects intact, a specific and identifiable group. Coverage that suggests every API user is at risk is wrong.

Understated: the invisible prompt injection primitive. That one does not depend on published logs. It depends on any pipeline where reasoning blocks flow between components, which describes essentially every serious agent framework, MCP-based tool stack, or multi-step orchestrator built in the last year. If reasoning objects can carry instructions that survive replay into unrelated tasks, the MCP-style architectures that assume opaque provider blobs are inert are wrong on that assumption. The mitigation of "strip thinking blocks when switching models" does not cover the case of an attacker who feeds a poisoned block into your own pipeline in the first place. The source does not document whether current mitigations block the injection variant or only the extraction variant, which is the question that actually determines whether agent developers can sleep tonight.

Key Takeaways

• The leak rate is structural, not incidental: 704 privacy artifacts across 315,320 decoded thinking blocks means encrypted reasoning objects were leaking at industrial scale, and 9 percent of recovered secrets existed only in hidden reasoning, invisible to any log-sanitization tool operating on visible text.
• No cryptography was broken: the attack worked by feeding intact opaque blocks to weaker same-family models (Haiku 4.5, GPT-5.6 Luna, Gemini Robotics ER-1.6) that willingly transcribed their bigger siblings' reasoning. This is a design-level failure of trusting portable opaque tokens.
• Vendor silence is the most important unresolved variable: mitigations reportedly work as of August 2026, but no public acknowledgment from OpenAI, Anthropic or Google has surfaced. The reproducibility claim rests on the researchers, not vendor confirmation, and the source does not address whether already-published reasoning blocks remain decodable, only whether fresh attacks still succeed.
• The prompt-injection variant is the one to watch: hiding a malicious instruction inside an opaque reasoning block that later triggers an attacker-directed action in an unrelated task defeats every defense that operates on visible conversation. Agent framework maintainers should assume reasoning artifacts from external sources are attacker-controlled.
• Concrete action for platform teams: strip reasoning blocks from any shared trace, treat raw API transcripts as credential-bearing even after visible-text sanitization, and audit any agent pipeline that persists or forwards provider reasoning objects between components.