How Researchers Recovered Encrypted Reasoning Traces from Leading AI Models and Exposed Credential Leaks

Researchers from MATS Research, the ELLIS Institute Tübingen and the Max Planck Institute for Intelligent Systems published a paper titled Stealing Reasoning Traces from Proprietary LLM APIs , demonstrating that the encrypted reasoning blocks used by Anthropic, OpenAI and Google can be extracted and replayed, allowing the full reasoning process of a strong model to be printed by a weaker sibling model.

The vulnerability stems from the design goal of protecting intellectual property: encrypted reasoning blocks were meant to hide how a model "thinks". In practice, the same block is fully compatible across different sessions, users and even models from the same vendor, turning the protection into a new attack surface.

Analyzing 6708 public agent‑trace datasets, the team reconstructed 315,000 reasoning blocks. Their audit uncovered 367 pieces of personally identifiable information, 62 valid API keys, 33 plaintext passwords, 24 access tokens, and 64 sensitive artifacts that exist only inside the encrypted blocks—making them invisible to existing DLP or CASB tools.

The attack works in three ways:

Cross‑session replay: an attacker captures an encrypted block from one session and replays it unchanged in another session.

Cross‑model injection: the captured block from a strong model is fed to a weaker sibling model from the same vendor, which decodes and reveals the strong model’s reasoning, bypassing the strong model’s alignment safeguards.

Bypassing four defenses: the technique defeats Anti‑Distillation controls, PII isolation mechanisms, Hazard Suppression strategies, and Hidden Prompt confidentiality.

Real‑world impact includes leaked API keys from publicly released enterprise AI‑agent logs, and the possibility of embedding malicious commands inside invisible reasoning blocks (hidden prompt injection), which are extremely hard to detect.

Security researcher Matthew Green reported the cross‑session replay flaw to OpenAI and Anthropic in May 2026 via a bug‑bounty program, but both vendors gave only perfunctory responses until the paper’s publication, raising concerns about vendor security‑response practices.

Defensive recommendations from the authors are:

Re‑evaluate and restrict access to published agent‑trace datasets, treating them as potential leakage sources.

Stop treating encrypted reasoning blocks as a "secure black box"; current DLP/CASB solutions cannot inspect them.

Monitor vendor‑issued fixes—no architectural patches have been released yet, and temporary hot‑fixes are insufficient.

Note that OWASP LLM Top 10 now lists sensitive information leakage as a primary risk, underscoring the urgency of mitigation.

The scale of the reconstruction—over three hundred thousand blocks—shows that this is not a theoretical concern but an active, systemic risk across major LLM providers.