Stealing Reasoning Traces from Proprietary LLM APIs

Summary: We find that encrypted chain-of-thought blocks are interchangeable across sessions with most LLM providers. This allows attackers to replay a frontier model trace into a weaker, jailbroken sibling which recovers the hidden reasoning verbatim, enabling distillation, large-scale extraction of private data such as secrets and PII from agent logs, safety violations, and invisible prompt injection.

Snyk contributed to a research project led by the ELLIS Institute Tübingen on a vulnerability arising from the fact that model providers encrypt the reasoning blocks of frontier models. When a proprietary model works through a problem, that private chain-of-thought used to be visible. Today Anthropic, OpenAI, and Google lock it away and hand it back to users as an unreadable blob. We found that these blobs are not tied to the conversation they came from, which allowed us to circumvent the encryption and extract hidden reasoning in plaintext.

How The Attack Works

For model reasoning to persist across multiple LLM API calls, it has to remain portable across requests while remaining opaque to users. However, after initial reports by Green (2026) in May of this year, it was confirmed that providers appear to authenticate every block under a single global key. As illustrated in Figure 1, we find that this enables scalable extraction via jailbreaking: attackers can capture an encrypted block from a strong model such as Claude Opus 4.8, attach it to a request to a weak, jailbroken model of the same family, and ask it to transcribe the attached reasoning. This allows the decryption of the original reasoning blocks, creating new risks of privacy and security violations for users and model vendors.

This method works reliably, unlike asking the strong model to transcribe its own reasoning directly, because safeguards are unevenly effective across a family. Frontier models are refusal-trained against disclosing their reasoning, while their cheaper siblings are optimized for cost and carry weaker defenses. Porting a valid block across that gap turns the sibling into a decryption oracle, leaves the frontier model’s alignment untouched, and never surfaces at the frontier endpoint. This is caused by the transport design combined with the fact that models, by definition, must be able to access and use their prior reasoning. Even though Green (2026) first showed that these blocks are portable and disclosed it in May 2026, providers at first did not acknowledge any security implications arising from this.

Fidelity is high enough that the recovered text can be treated as the original. Measured as the ratio of extracted reasoning tokens to the thinking tokens the API bills for the source model, extraction over 120 Codeforces problems per model has a median of 1.00 for all three providers, with 82% to 89% of traces landing within 5% of their original length. Decoding the signature also returns roughly five times more reasoning than the summary the provider exposes to the client. See the full paper for more details.

Responsible Disclosure All findings and extraction methodologies were disclosed to the affected model providers ahead of publication, together with the preliminary results of the scans over public datasets. Every provider acknowledged the report, and the attacks described here no longer reproduce against their APIs. The vulnerability has largely been mitigated by tightening reasoning block validation, e.g. by hashing session-specific information into the envelope so that a block only verifies within the conversation and for the model that produced it.

Implications and Advisory

While this attack at first appears to be primarily a vendor concern, we find that breaking confidentiality in this way has severe implications for LLM users as well.

Privacy

Secrets, credentials, and personally-identifiable information may have been breached through encrypted reasoning blocks. Any agent transcript that was shared, committed, or retained while carrying its reasoning blocks should be treated as a potential disclosure of everything the model reasoned over, including material the person who published it could not see and therefore could not redact. Prior work on unencrypted reasoning models establishes this asymmetry for private data, showing that traces regularly restate sensitive context the visible answer never mentions and that reasoning is therefore its own attack surface (Green et al., 2025). Our paper looks at this more concretely: decoding a sample of 315,320 encrypted reasoning blocks sourced from 6,708 public agent trajectories recovered 367 PII artifacts and 182 credentials, among them 62 API keys and 33 passwords from user sessions.

Any sanitization of such traces can only operate on the plaintext level and will not reach encrypted contents. Users hold no decryption capability, so the only remediation is to strip reasoning blocks altogether before sharing them. Affected users should consider sensitive information exposed in reasoning traces as breached. This concerns not only providers, but all users of agent systems that store or share transcripts, and in particular teams with agents touching production and critical infrastructure, which are at much higher risk of exposure than the public traces that were analyzed as part of our investigation. Figure 4 illustrates example contents of decrypted reasoning which leaks personal and credential data.

Safety and Security

Because models withhold harmful content from their output rather than avoid reasoning about it, attackers can leverage decrypted reasoning to bypass safety filters that only apply to visible answer turns. However, reasoning could also be poisoned by a third party and then injected by replay. In this, a malicious instruction planted in a block and replayed into a later session is treated by the model as its own prior reasoning, and thus as a highly trusted directive. In a proof-of-concept we find we can include malicious instructions in reasoning blocks, that produce a script that quietly exfiltrates user data to an attacker’s server. The payload never appears in the visible conversation, so neither the user nor simple monitors detect the attack. These implications affect users and operators of agents that resume shared, cached, or third-party sessions, and anyone relying on simple output filters or reasoning monitors as a safety control.

Distillation

Lastly, a model’s reasoning is a far denser training signal than its final answer, and extraction recovers it verbatim without ever querying the safeguarded model for it. Where the reasoning is harvested from published logs, the expensive generation has already been paid for by someone else: decoding 10,000 traces through Haiku 4.5 amounts to negligible API cost compared to bigger models and monitors on frontier endpoints see no typical distillation traffic. This affects all model vendors and providers of custom models that want to keep their model reasoning confidential, and that need to prevent competitors from replicating it.

Interestingly, decoded traces are also useful as a probe for distillation that may already have happened. We find that prefilling Kimi-K3 with tokens from of a decoded Opus 4.8 trace shifts both its subsequent reasoning and its visible answer toward Claude’s style, while we see no comparable effect with other models such as Inkling.

A Shifting Threat Model

The underlying attack surface of this investigation exists only because providers choose to conceal reasoning while keeping transport practically stateless (client-side storage). This contributes to an ongoing shift in AI threat models. Models and agent systems cannot be considered outside of the ecosystems they live in, including API limitations, commercial and political interests, as well as the vendors that fund and publish their advances in frontier models.

At the same time, it shows how vendor-friendly measures such as encrypted reasoning blocks can put the users of such systems at risk. Distillation defenses are hardened, but at the cost of privacy violations and hidden prompt injections that users of such APIs cannot protect against. Users lose sight of their own data, unable to tell what a hidden trace retained or how it shaped the model’s actions, which makes privacy violations undetectable by design. Even after patching the vulnerabilities described here, encrypted reasoning is only ever semi-hidden, since whatever model is queried must decrypt prior reasoning to continue from it. Please see the full paper for more discussion of the consequences and guidance on the broader mitigations.

Powerful Response and Open Research

The response to this work has been substantial. All model providers very quickly acknowledged and mitigated the reported vulnerabilities, providing proof of the criticality of the underlying issue and threat model. Beyond that, however, the research community has also responded strongly, with many sharing reports of similar techniques, and long-standing hypotheses about the hidden reasoning of frontier models could suddenly be checked against real traces rather than inferred from summaries.

For a brief moment frontier reasoning was legible again, and the community responded accordingly: decoded traces show how frontier models actually work through a problem, what their reasoning looks like before a summarizer condenses it, where obfuscation and other artifacts of training and distillation surface, and how a model reasons about its own alignment or about the grader scoring it. At the same time, it makes it obvious how little of this material anyone working in the open normally has. Safety and security research on production models proceeds largely without access to the these important artifacts.

A broad community with access to unredacted reasoning could contribute to alignment and safety tuning in a genuinely pluralistic way, instead of leaving oversight to the few inside the labs. Ultimately, whether reasoning should be encrypted at all remains open.

Blog post by Luca Beurer-Kellner