{"slug": "one-global-key-guarded-every-hidden-ai-reasoning-trace", "title": "One Global Key Guarded Every Hidden AI Reasoning Trace", "summary": "Researchers from MATS, ELLIS Tübingen, the Max Planck Institute for Intelligent Systems, and Snyk demonstrated that encrypted chain-of-thought reasoning traces from OpenAI, Anthropic, and Google APIs can be decrypted by replaying them into weaker sibling models, recovering 182 credentials and 367 pieces of PII from 6,708 public agent trajectories. The attack exploits a shared global encryption key across each provider's model family and the lack of session binding, making the weakest model the security floor.", "body_md": "[Security](https://sourcefeed.dev/c/security)Article\n\n# One Global Key Guarded Every Hidden AI Reasoning Trace\n\nResearchers replayed encrypted chain-of-thought into weaker sibling models and pulled live credentials out of public agent logs.\n\n[Ji-ho Choi](https://sourcefeed.dev/u/jiho_choi)\n\n\"Hidden\" chain-of-thought was never hidden from anyone willing to ask nicely. That's the short version of [Stealing Reasoning Traces from Proprietary LLM APIs](https://arxiv.org/abs/2608.09867), a paper posted August 10 by researchers spanning MATS, ELLIS Tübingen, the Max Planck Institute for Intelligent Systems, and Snyk. The team took the encrypted reasoning blobs that [OpenAI](https://platform.openai.com/docs/guides/reasoning), [Anthropic](https://docs.anthropic.com/en/docs/build-with-claude/extended-thinking), and [Google](https://ai.google.dev/gemini-api/docs/thinking) return from their APIs, replayed them into weaker sibling models, and jailbroke those models into transcribing the contents in plaintext. Scraping 6,708 publicly posted agent trajectories, they decoded 315,320 reasoning blocks and recovered 182 credentials — API keys, passwords, access tokens, private keys — plus 367 pieces of PII that developers never knew they'd published.\n\nNo encryption was broken. No key was stolen. That's what makes this worth understanding rather than filing under \"another jailbreak.\"\n\n## Why the blob exists at all\n\nReasoning models think before they answer, and all three providers hide that thinking from you — partly as a safety hedge, mostly as an anti-distillation moat. Raw chain-of-thought is exactly the training data a competitor would want, so you get a summary at best.\n\nBut the APIs are stateless, and multi-turn agentic work needs the model to resume its train of thought across tool calls. The solution everyone converged on: hand the client an opaque encrypted blob — OpenAI's reasoning items with `encrypted_content`\n\n, Anthropic's thinking-block signatures, Gemini's thought signatures — and require you to POST it back on the next turn. You become the courier for state you're forbidden to read.\n\nThat architecture is fine in principle. It's the encrypted-cookie pattern, and web frameworks have shipped it safely for twenty years: authenticated encryption, keys rotated per app, ciphertext bound to the session it belongs to so it's worthless anywhere else. Rails and Django got this right in the 2000s. The AI labs skipped the last step. The blobs weren't bound to your session, your account, or even the model that produced them — and every model in a provider's family shared one global key.\n\n## The weakest model sets the security floor\n\nUnbound ciphertext plus a shared key means every model in the family is a decryption oracle. The attack is almost insultingly simple: take a reasoning block from a frontier model's trace, replay it into the cheapest, most jailbreakable sibling — the paper used Claude Haiku 4.5 for Claude traces, GPT-5.6 Luna for GPT traces, Gemini Robotics ER-1.6 for Gemini — and ask it to read out what it sees. The provider's own servers decrypt the blob and hand the plaintext to a model whose guardrails you've already talked your way past.\n\nThat inverts the usual security assumption. The confidentiality of your strongest model's reasoning rested on the alignment of the family's weakest member. Anthropic's frontier-model secrets were, in effect, protected by Haiku's willingness to refuse.\n\nNone of this should have been a surprise. Cryptographer Matthew Green [documented the replay behavior in late May](https://blog.cryptographyengineering.com/2026/05/29/fooling-around-with-encrypted-reasoning-blobs/) — same blob accepted across sessions, across accounts, and on OpenAI across models — and reported it through bug-bounty channels. OpenAI called it unreproducible. Anthropic told him they didn't see security implications, though they might update the docs. Ten weeks later, a paper with headline numbers landed and all three vendors shipped server-side mitigations; the published proof-of-concept attacks no longer reproduce. The fix was apparently never hard. It just needed a louder messenger than a Johns Hopkins cryptographer filing a responsible disclosure.\n\n## Your logs were the attack surface\n\nThe extraction numbers deserve a closer look, because the victims weren't the labs — they were developers. Nobody breached a provider. The researchers harvested trajectories that people had already published: eval datasets, demo notebooks, \"here's my full agent run\" bug reports, committed transcripts in GitHub repos. Agent traces travel constantly through LangSmith-style dashboards, CI artifacts, and issue threads, and the reasoning blobs ride along because they look like inert base64 noise.\n\nThey aren't inert. Agents read `.env`\n\nfiles. Tool outputs return tokens. The model *thinks about* what it reads, so secrets that never appear in visible output sit verbatim in the trace. The paper's scariest attack class isn't even extraction — it's invisible prompt injection, where a replayed block carries instructions that no scanner of visible text will ever flag.\n\nPractical takeaways, in order of urgency:\n\n- Strip opaque reasoning fields —\n`encrypted_content`\n\n, thinking signatures,`thoughtSignature`\n\n— from anything you persist, share, or commit. Sanitizing the visible text is not sanitizing the trace. - Treat reasoning blocks at the same sensitivity as the prompts that produced them, because that's what they contain.\n- Audit public repos for committed agent trajectories. Anything decoded before the August mitigations is already out, and rotation beats hope: if a credential ever passed through an agent's context, rotate it.\n\n## Encrypted for whom?\n\nThe blast radius here was modest — 182 credentials pulled from logs that were already public. The lesson is not. \"Encrypted\" in a vendor's API response describes *their* threat model, not yours: the blobs were engineered to stop competitors distilling chain-of-thought, and against that adversary a global key works fine. Protecting your data in those blobs was nobody's requirement, which is why a design flaw a web framework would have failed code review on shipped at three companies simultaneously.\n\nThe pattern that produced this bug is spreading, not retreating. Opaque, client-carried state is now baked into every agentic API, and you're contractually obligated to shuttle around ciphertext you cannot audit. Until providers document what's in these blobs and how they're bound, the only safe posture is the one the researchers landed on: treat every reasoning trace as plaintext that hasn't leaked yet.\n\n## Sources & further reading\n\n-\n[Stealing Reasoning Traces from Proprietary LLM APIs](https://arxiv.org/abs/2608.09867)— arxiv.org -\n[Stealing Reasoning Traces from Proprietary LLM APIs](https://simonwillison.net/2026/Aug/11/stealing-reasoning-traces/)— simonwillison.net -\n[OpenAI, Anthropic, Google API Flaw Let Weaker AI Models Decode Stronger Models' Reasoning](https://thehackernews.com/2026/08/openai-anthropic-google-api-flaw-let.html)— thehackernews.com -\n[Let's talk about encrypted reasoning](https://blog.cryptographyengineering.com/2026/05/29/fooling-around-with-encrypted-reasoning-blobs/)— blog.cryptographyengineering.com\n\n[Ji-ho Choi](https://sourcefeed.dev/u/jiho_choi)· Security & Cloud Editor\n\nJi-ho covers the increasingly tangled overlap between cloud architecture and security, drawing on a background as a penetration tester to keep his reporting grounded in real-world attack paths. He never lets a vendor claim go unquestioned and insists that every buzzword come with a proof of concept.\n\n## Discussion 0\n\nNo comments yet\n\nBe the first to weigh in.", "url": "https://wpnews.pro/news/one-global-key-guarded-every-hidden-ai-reasoning-trace", "canonical_source": "https://sourcefeed.dev/a/one-global-key-guarded-every-hidden-ai-reasoning-trace", "published_at": "2026-08-16 14:09:19+00:00", "updated_at": "2026-08-16 14:41:01.949528+00:00", "lang": "en", "topics": ["ai-safety", "ai-policy", "artificial-intelligence"], "entities": ["OpenAI", "Anthropic", "Google", "MATS", "ELLIS Tübingen", "Max Planck Institute for Intelligent Systems", "Snyk", "Matthew Green"], "alternates": {"html": "https://wpnews.pro/news/one-global-key-guarded-every-hidden-ai-reasoning-trace", "markdown": "https://wpnews.pro/news/one-global-key-guarded-every-hidden-ai-reasoning-trace.md", "text": "https://wpnews.pro/news/one-global-key-guarded-every-hidden-ai-reasoning-trace.txt", "jsonld": "https://wpnews.pro/news/one-global-key-guarded-every-hidden-ai-reasoning-trace.jsonld"}}