Three Providers, One Broken Key, 315,320 Exposed Blocks

The providers told you the reasoning was hidden. They encrypted it. They called it protected intellectual property. What they did not tell you is that the encryption uses what appears to be a single global key, shared across every session, every user, and every model in their ecosystem.

That is not encryption. That is a label on a box someone left unlocked.

Rather than storing reasoning traces server-side, providers return them to the client as blocks of encrypted text. These encrypted blocks are fully compatible and interchangeable across different sessions, users, and models within a provider's ecosystem. The paper, submitted August 10 by teams from the ELLIS Institute Tübingen, Max Planck Institute, MATS Research, and Snyk, is titled Stealing Reasoning Traces from Proprietary LLM APIs (arXiv:2608.09867). It does not describe theory.

How the Attack Works

The mechanics are almost elegant. Researchers exploit this compatibility to develop a scalable decryption jailbreak. By injecting an encrypted reasoning trace from a given model into a weaker, less safeguarded model from the same provider, they force it to decode and output the trace verbatim in plaintext.

Translation: Opus 4.8 refuses to show you its thinking. Haiku 4.5 does not. The encryption treats a Haiku session as equally authorized as the Opus session that produced the trace. Hand Haiku the encrypted blob, jailbreak Haiku, and read Opus's internal monologue word for word.

Frontier models such as Claude Opus 4.8 or GPT-5.6 Sol are heavily safeguarded with refusal training designed to prevent disclosure of internal chains of thought. Less capable siblings, such as Claude Haiku 4.5 or GPT-5.6 Luna, are optimized for cost and speed, often lacking stringent anti-distillation defenses.

This is not a bug in one provider's implementation. All three major providers encrypt reasoning blocks with what appears to be a single global key, making any block replayable across any session, account, or model within the provider. OpenAI, Anthropic, and Google converged on the same architectural shortcut.

What Was Already in the Wild

This is where the numbers get uncomfortable. Paper authors recovered 315,320 reasoning blocks from public repositories, finding 367 PII artifacts and 182 credentials already extractable by any API caller. Those blocks came from agent logs and published workflows developers posted to GitHub and Hugging Face without realizing the encrypted payload was not, in practice, encrypted against anyone who knew how to ask.

These are not simulated numbers. They are counts from blocks circulating in public repositories today.

The warning signal came ten weeks ago and was ignored. On May 29, 2026, Johns Hopkins cryptographer Matthew Green published findings on encrypted reasoning. He found reasoning blocks could be replayed within a session, across sessions, and across entirely separate accounts. For OpenAI, they replayed across different models too, though Claude "got fussy" about that at the time.

Independent researchers documented the same vulnerability in May and June 2026, yet Anthropic, OpenAI, and Google issued no architectural fixes before this paper confirmed that 315,320 exploitable blocks are circulating in public repositories.

Three months. No patch.

What You Need to Do Before Remediation Arrives

Providers may have shipped mitigations between the paper's submission and your reading of this; check their security advisories for current status. Do that now.

While you wait: Strip reasoning blocks before sharing any logs or agent trajectories. Treat them as sensitive payload rather than protocol overhead. Sanitize chat inputs. If your application forwards user-supplied content into an LLM API, an attacker who can inject JSON into your conversation stream can inject their own reasoning blocks.

If your compliance posture rests on the assumption that API-level encryption protects reasoning content, that posture is now unsupported by evidence. Hidden traces contain far more dense and sensitive information than final output, including intermediate hypotheses, tool outputs, user data, and contextual secrets. PII and secret leakage can be assumed to be much more widespread in local trace storage or traces of production services, creating significant compliance risks.

The real cost is not the remediation sprint. It is the time you spent trusting a security model that providers never defended in their documentation, and that a cryptographer cracked over a weekend in May.

What to watch: Provider security advisories for architectural fixes, not policy updates. Whether the fix is server-side key binding per session or requires client changes. Any SEC disclosures naming the exposure window. Whether smaller providers running similar reasoning architectures quietly share the same flaw.