The encrypted reasoning paradox: when protecting intellectual property exposes data

On 10 August 2026 the preprint 'Stealing Reasoning Traces from Proprietary LLM APIs' was posted on arXiv, a study of the weaknesses built into the way language models' chains of reasoning are protected. According to the authors, the main API providers — Anthropic, OpenAI and Google among them — follow a practice in which the reasoning text is not returned in the clear but as an encrypted block, which the client attaches again to subsequent requests. The paper's abstract points to an architectural flaw: those encrypted blocks are, in the authors' words, "fully compatible and interchangeable across different sessions, users and models within the same provider's ecosystem".

That interchangeability enables an attack in which an encrypted block produced by a flagship model is dropped into an API call to a smaller, less protected model from the same provider, which hands it back in plain text. An analysis of 315,320 blocks recovered 367 pieces of personal data and 182 credentials. The work is a preprint that has not yet been peer reviewed, and the figures on recovered data have not been independently verified; the breakdown of the 182 credentials comes from a single secondary source. According to Cyber Security News, those include 62 API keys, 33 passwords and 30 email addresses, pulled from publicly available agent transcripts. The attack needs nothing more than standard API access, sidesteps anti-distillation protections and can expose dangerous information or invisible prompt injection.

What has actually been fixed remains murky. In its 11 August coverage, Cyber Security News states that all three providers applied server-side mitigations that make the proofs of concept impossible to reproduce; AI Weekly, on the same date, maintains that no architectural change has been made. At the time of checking, none of the companies involved had issued an official statement backing either account. The project site cited for additional technical detail, stolen-thoughts.com, was also unreachable (HTTP 403 error), ruling out a full indirect reconstruction of the methodology.

The hole does not come from a one-off implementation mistake but from a design choice that puts intellectual property ahead of confidentiality. The recommended countermeasures are to bind the block cryptographically to the model, the session and the user it came from, and to clean logs before publishing them. Until it is clear whether the mitigations applied touch the link between encrypted block and originating context, there is no way to judge from the outside how much risk is left.

— Olya