One Global Key Guarded Every Hidden AI Reasoning Trace

"Hidden" chain-of-thought was never hidden from anyone willing to ask nicely. That's the short version of Stealing Reasoning Traces from Proprietary LLM APIs, a paper posted August 10 by researchers spanning MATS, ELLIS Tübingen, the Max Planck Institute for Intelligent Systems, and Snyk. The team took the encrypted reasoning blobs that OpenAI, Anthropic, and Google return from their APIs, replayed them into weaker sibling models, and jailbroke those models into transcribing the contents in plaintext. Scraping 6,708 publicly posted agent trajectories, they decoded 315,320 reasoning blocks and recovered 182 credentials — API keys, passwords, access tokens, private keys — plus 367 pieces of PII that developers never knew they'd published.

No encryption was broken. No key was stolen. That's what makes this worth understanding rather than filing under "another jailbreak."

Why the blob exists at all

Reasoning models think before they answer, and all three providers hide that thinking from you — partly as a safety hedge, mostly as an anti-distillation moat. Raw chain-of-thought is exactly the training data a competitor would want, so you get a summary at best.

But the APIs are stateless, and multi-turn agentic work needs the model to resume its train of thought across tool calls. The solution everyone converged on: hand the client an opaque encrypted blob — OpenAI's reasoning items with encrypted_content, Anthropic's thinking-block signatures, Gemini's thought signatures — and require you to POST it back on the next turn. You become the courier for state you're forbidden to read.

That architecture is fine in principle. It's the encrypted-cookie pattern, and web frameworks have shipped it safely for twenty years: authenticated encryption, keys rotated per app, ciphertext bound to the session it belongs to so it's worthless anywhere else. Rails and Django got this right in the 2000s. The AI labs skipped the last step. The blobs weren't bound to your session, your account, or even the model that produced them — and every model in a provider's family shared one global key.

The weakest model sets the security floor

Unbound ciphertext plus a shared key means every model in the family is a decryption oracle. The attack is almost insultingly simple: take a reasoning block from a frontier model's trace, replay it into the cheapest, most jailbreakable sibling — the paper used Claude Haiku 4.5 for Claude traces, GPT-5.6 Luna for GPT traces, Gemini Robotics ER-1.6 for Gemini — and ask it to read out what it sees. The provider's own servers decrypt the blob and hand the plaintext to a model whose guardrails you've already talked your way past.

That inverts the usual security assumption. The confidentiality of your strongest model's reasoning rested on the alignment of the family's weakest member. Anthropic's frontier-model secrets were, in effect, protected by Haiku's willingness to refuse.

None of this should have been a surprise. Cryptographer Matthew Green documented the replay behavior in late May — same blob accepted across sessions, across accounts, and on OpenAI across models — and reported it through bug-bounty channels. OpenAI called it unreproducible. Anthropic told him they didn't see security implications, though they might update the docs. Ten weeks later, a paper with headline numbers landed and all three vendors shipped server-side mitigations; the published proof-of-concept attacks no longer reproduce. The fix was apparently never hard. It just needed a louder messenger than a Johns Hopkins cryptographer filing a responsible disclosure.

Your logs were the attack surface

The extraction numbers deserve a closer look, because the victims weren't the labs — they were developers. Nobody breached a provider. The researchers harvested trajectories that people had already published: eval datasets, demo notebooks, "here's my full agent run" bug reports, committed transcripts in GitHub repos. Agent traces travel constantly through LangSmith-style dashboards, CI artifacts, and issue threads, and the reasoning blobs ride along because they look like inert base64 noise.

They aren't inert. Agents read .env files. Tool outputs return tokens. The model thinks about what it reads, so secrets that never appear in visible output sit verbatim in the trace. The paper's scariest attack class isn't even extraction — it's invisible prompt injection, where a replayed block carries instructions that no scanner of visible text will ever flag.

Practical takeaways, in order of urgency:

• Strip opaque reasoning fields — encrypted_content, thinking signatures, thoughtSignature — from anything you persist, share, or commit. Sanitizing the visible text is not sanitizing the trace.
• Treat reasoning blocks at the same sensitivity as the prompts that produced them, because that's what they contain.
• Audit public repos for committed agent trajectories. Anything decoded before the August mitigations is already out, and rotation beats hope: if a credential ever passed through an agent's context, rotate it.

Encrypted for whom?

The blast radius here was modest — 182 credentials pulled from logs that were already public. The lesson is not. "Encrypted" in a vendor's API response describes their threat model, not yours: the blobs were engineered to stop competitors distilling chain-of-thought, and against that adversary a global key works fine. Protecting your data in those blobs was nobody's requirement, which is why a design flaw a web framework would have failed code review on shipped at three companies simultaneously.

The pattern that produced this bug is spreading, not retreating. Opaque, client-carried state is now baked into every agentic API, and you're contractually obligated to shuttle around ciphertext you cannot audit. Until providers document what's in these blobs and how they're bound, the only safe posture is the one the researchers landed on: treat every reasoning trace as plaintext that hasn't leaked yet.