Summary: In the reasoning-model era, every major API hands the model’s thinking process back to the developer. The authors come from a team spanning MATS Research, the ELLIS Institute Tübingen, the Max Planck Institute for Intelligent Systems, Snyk, and other institutions. Anthropic, OpenAI, and Google wrap that thinking in a signed or encrypted block that looks unreadable on arrival.
In the reasoning-model era, every major API hands the model’s thinking process back to the developer. Anthropic, OpenAI, and Google wrap that thinking in a signed or encrypted block that looks unreadable on arrival. A paper posted to arXiv on August 10 and discussed widely on Hacker News on August 11 — “Stealing Reasoning Traces from Proprietary LLM APIs” — finds an unexpected hole in that arrangement: the thinking blocks are encrypted, but they travel.
The authors come from a team spanning MATS Research, the ELLIS Institute Tübingen, the Max Planck Institute for Intelligent Systems, Snyk, and other institutions. The most ironic thing about their attack is that the strong model is never touched. Every step runs against the same vendor’s weaker sibling model.
How the Attack Works: Two API Calls
The procedure is short. Take the encrypted thinking block a strong model produced — Anthropic’s claude-opus-4-8, say — and replay it into a conversation with the same vendor’s weaker, less-guarded sibling (claude-haiku-4-5) without altering anything. Then jailbreak that weak model and ask it to transcribe the “unreadable input” verbatim. Two calls later, the strong model’s reasoning sits in plaintext.
The OpenAI side behaves the same way: GPT-5.2 Codex thinking traces were decoded with GPT-5.6 Luna, and Google’s API showed the identical weakness. To establish that the transcripts are genuine rather than hallucinated, the team ran 120 Codeforces problems: the length of the recovered reasoning tracks the hidden thinking-token counts the API itself reports.
Scanning Public Trajectories: Secrets Sit Inside Thoughts
Past the attack itself, the paper reports a measurement closer to ordinary practice. The team scanned 6,708 public agent trajectories and reconstructed 315,320 thinking blocks from them, identifying 704 distinct privacy artifacts inside: 62 API keys, 33 passwords, 24 access tokens, and 30 personal email addresses. Sixty-four of those artifacts lived only in the reasoning and never appeared in visible output. (The arXiv abstract reports a narrower subset — 367 PII artifacts and 182 credentials — from the same scraped blocks.)
Chains of thought, in short, are turning into a fresh boundary for data leakage: users and agents deposit secrets in a place “only the model should see,” and that place is now demonstrably readable.
Four Attacks from One Design Flaw
The paper lays out four attack lines. First, anti-distillation protections can be bypassed: reasoning traces were extracted from Anthropic, OpenAI, and Google alike, which makes the safeguards meant to keep traces out of rival training pipelines largely nominal. Second, mass private-data extraction — the scan described above. Third, a thinking block can carry hazardous content while the visible answer stays perfectly benign, so anyone auditing outputs sees nothing. Fourth, invisible prompt injection: instructions ride into later turns inside the thinking block itself.
One supplementary experiment deserves a mention: prefilling reasoning content into Moonshot’s Kimi-K3 changes its answers. These blocks are more than text; they hold real control over model behavior.
Root Cause and Fixes: It Is Not About Crypto Strength
What fails here is not cryptography but a design choice: a thinking block works across conversations, across users, and across models, which makes it a bearer token in effect. After responsible disclosure to the affected providers, the authors propose cryptographic and system-level mitigations aimed at binding each thinking block to a single conversation, a single user, and a single model. The idea mirrors a session token: a block minted for one conversation ought to fail validation anywhere else. The paper also raises a detail that is easy to overlook: the reasoning summaries APIs return can misstate the actual thinking — and any oversight mechanism built on those summaries is open to manipulation.
What It Means for Developers
Three practical takeaways. First, keep secrets out of the context you send a model: they can end up written into reasoning and later reconstructed. Second, before you publish agent trajectories — logs, traces, demo data — scrub the thinking blocks along with everything else. Third, when you evaluate a vendor, add one question: how are thinking blocks signed, and how are they bound to a conversation? In the reasoning-model era, the thought process is itself an asset that needs access control.