Alexander Panfilov (@kotekjedi_ml), David Schmotz and Ilia Shumailov (@iliaishacked) found a way to recover encrypted reasoning generated by models from OpenAI, Anthropic and Google, according to a paper posted on August 10th.
The attack exploited a convenience built into reasoning-model APIs. Providers can return a model's hidden chain of thought as an encrypted block that customers store and send back during later requests. Official OpenAI guidance describes passing back encrypted reasoning items in client-managed workflows, while Google's documentation says Gemini thought signatures preserve reasoning context across API calls.
The researchers found that these blocks could be moved between users, sessions and models inside the same provider's product family. They fed reasoning from a stronger model into a cheaper, weaker sibling, then prompted the smaller model to transcribe the hidden material. The stronger model's safeguards never had to approve the disclosure.
Panfilov is a MATS fellow whose previous work has examined how prompt injections can defeat AI control monitors. The paper's other authors are Luca Beurer-Kellner (@lbeurerkellner), Joachim Schaeffer (@JSchaeff3r), Ameya Prabhu (@AmyPrb), Jonas Geiping (@jonasgeiping) and Maksym Andriushchenko (@maksym_andr). Their affiliations include MATS Research, the ELLIS Institute Tubingen, the Max Planck Institute for Intelligent Systems, the Tubingen AI Center, Snyk, the University of Tubingen and AI Sequrity Company.
A weaker model became the decoder
The researchers tested the attack against API versions available in early July 2026. For Anthropic, they moved encrypted reasoning from more capable Claude models into Haiku 4.5. They used GPT-5.6 Luna as a decoder for OpenAI reasoning and Gemini Robotics 1.6 for Google traces.
Their validation has an important limit. The researchers lacked access to the providers' original plaintext chain of thought, so they could not compare each recovered word against a definitive source. They instead compared extracted length with the APIs' reported reasoning-token counts and inspected whether the recovered text contained details absent from visible summaries. The paper says the token counts tracked closely across tests on 120 Codeforces problems, indicating that the extraction recovered much of the hidden trace.
The method created four attack paths. A developer could collect reasoning for model distillation, recover private data from another user's published logs, reveal harmful details that appeared in hidden reasoning despite a safe final answer, or place invisible instructions inside an encrypted block that an agent later treats as its own prior thought.
The last scenario turns reasoning continuity into a prompt-injection channel. In one proof of concept, the researchers placed an instruction to upload a PowerPoint file inside an encrypted reasoning block. A later model produced an editing script that also sent the presentation to an attacker-controlled server, while the visible conversation contained no corresponding instruction.
Public logs contained credentials
The researchers collected 6,708 publicly available agent trajectories from GitHub and Hugging Face and reconstructed 315,320 reasoning blocks. Their automated review flagged at least one privacy leak in 1,028 blocks, or 0.3% of the sample. At the session level, 328 trajectories, or 4.9%, contained at least one item the paper classified as sensitive.
Across the full dataset, including synthetic benchmark sessions, the researchers counted 367 personally identifiable information artifacts and 182 credentials. Genuine user sessions yielded 62 distinct API keys, 33 passwords and 30 personal email addresses, according to the paper. Some artifacts appeared only inside the encrypted reasoning and were absent from the visible conversation, meaning conventional log sanitization would not have found them.
Those figures require context. The dataset was a targeted collection rather than an audit of all public agent logs, and benchmark trajectories accounted for much of the personal information because some tests deliberately supply models with synthetic identities. The researchers said they deleted recovered secrets after classification.
Providers blocked the reported attacks
The paper builds on cryptographer Matthew Green's May 29th analysis of encrypted reasoning, which showed that reasoning blocks could be replayed outside their original context. Green reported the behavior to OpenAI and Anthropic, while describing the immediate security impact as uncertain.
Panfilov and his coauthors extended that finding by using weaker models as transcription tools and applying the technique to public logs. They disclosed their methods to the affected model providers, Microsoft and Hugging Face before publication. The paper says every model provider acknowledged the report and that the researchers subsequently could no longer reproduce the same attacks.
AI security researcher Timothee Chauvin (@timotheechauvin) described the issue as limited in consequence in a seven-post thread on X, while criticizing the providers for leaving a basic security weakness across encrypted reasoning systems.
The researchers proposed binding each encrypted block to its original user, session and place in the conversation. They also recommended rotating old keys so reasoning blocks issued before a fix become unreadable, training models to reject transcription requests and moving reasoning storage back to provider servers where practical.
Those changes carry costs. Client-held reasoning supports stateless APIs, zero-data-retention deployments and model switching without requiring providers to retain every hidden trace. The vulnerability came from preserving that portability too broadly. The same block that kept an agent's reasoning intact across requests also crossed boundaries that encryption was expected to enforce.