Frontier Model API Encrypted Reasoning Traces Extractable; Three Major Vendors Face Privacy Leak Risks

On August 11, 2026, a research team published the paper "Stealing Reasoning Traces from Proprietary LLM APIs," confirming that OpenAI, Anthropic, and Google's APIs return models' step-by-step reasoning processes to clients as encrypted blocks, and that these blocks can be replayed across sessions, users, and models within the same vendor's ecosystem.

Attack Mechanism Stems from Architectural Choices

To prevent their reasoning processes from being directly distilled, vendors chose to have clients relay encrypted reasoning blocks rather than storing them on servers. The research found that these blocks are not bound to specific sessions or models, allowing weaker models to be used to decode content from stronger models. An attacker first has a strong model generate encrypted blocks, then injects them into a weaker model and performs a simple jailbreak, enabling verbatim output of plaintext reasoning traces.

The paper verified that the number of extracted tokens roughly matches the thinking tokens billed by the API at a 1:1 ratio. This method bypasses the anti-distillation defenses of strong models by directly leveraging weaker models from the same vendor to complete the decoding.

Public Logs Expose Large Amounts of Sensitive Data

The research team scanned 6,700 to 7,000 agent traces in public code repositories, decoded 315,320 reasoning blocks, and recovered 367 pieces of personally identifiable information and 182 credentials, including 62 unique API keys, 33 passwords, and 33 email addresses. This information mostly existed only in hidden reasoning and was not shown in the final outputs.

Developers often publicly share logs containing encrypted blocks without realizing their contents can be reconstructed. The scale of this leakage shows that current API designs directly expose privacy risks in log-sharing scenarios.

Four Types of Attack Vectors Confirmed

• Bypassing anti-distillation: reasoning traces from frontier models can be extracted for training other models.
• Large-scale data extraction: credentials and PII can be recovered from public logs.
• Revealing hidden dangerous behaviors: even when the final output refuses a request, the reasoning process may contain scheming or anomalous loops.
• Stealthy prompt injection: malicious payloads can be embedded in encrypted blocks to poison public agent executions.

Paper author Alexander Panfilov noted that Matthew Green had already reported the replay issue in May 2026, and vendors at the time believed there was no significant security impact. This study systematically demonstrates cross-model portability.

Practical Impact at the Industry Level

This vulnerability directly challenges the assumption that "hidden reasoning protects intellectual property." As long as a vendor has models with weaker defenses, the reasoning processes of stronger models can be indirectly extracted. After a small number of Opus reasoning tokens were used to prefill other models, output styles showed a shift, demonstrating that the distillation risk is real.

For API security design, the practice of having clients hold encrypted blocks has proven unsustainable. Mechanisms such as session binding or model-specific keys need to be introduced to prevent cross-model decoding.

Independent Assessment

The core issue in this incident lies not in the encryption algorithm itself, but in architectural decisions that expose decodable reasoning blocks to clients. Vendors have completed partial fixes through responsible disclosure; the fundamental solution lies in reassessing the necessity of having clients relay encrypted reasoning. If future API designs continue to rely on this model, similar dimensionality-reduction attacks will persist.