Researchers decrypted 315,320 hidden reasoning blocks from frontier LLM APIs

The hidden reasoning of frontier AI models was less hidden than everyone assumed.

The flaw

A paper posted to arXiv on August 10, “Stealing Reasoning Traces from Proprietary LLM APIs,” describes an architectural problem in how proprietary models conceal their chain-of-thought. The authors, from Tuebingen, the Max Planck Institute, MATS and Snyk among other institutions, start from how the hiding works in practice: when a provider conceals reasoning, it still returns that reasoning to the client as encrypted blocks.

Those blocks turned out to be compatible and interchangeable across sessions, users and models within a provider’s ecosystem. A block generated in one context could be used in another, which enabled what the paper calls a scalable decryption jailbreak: the encrypted reasoning could be recovered at volume rather than one trace at a time.

What they recovered

The team decoded 315,320 reasoning blocks scraped from public repositories, where developers had committed API responses. From those they recovered 367 pieces of personally identifiable information and 182 live credentials.

To confirm the reconstruction was real rather than a plausible fabrication, they matched their token counts 1:1 against the thinking tokens billed by the API. The authors say the vulnerability affected the APIs of every frontier AI company. That claim is the authors’ own; provider responses are not part of the paper.

Two lessons

The first lesson is for providers. Protecting the visible answer is only half of protecting the system. Hidden reasoning that can be decrypted by anyone holding the ciphertext is not hidden, and the interchangeability of blocks across users is the property that turned a theoretical weakness into a scalable one.

The second is for developers. The 315,320 blocks were scraped from public repositories, meaning the raw material for the attack was supplied by teams committing API logs to code they published. The credentials and personal data recovered came from those logs. Any team that has pushed raw API responses, including encrypted reasoning blocks, into a public repo has an exposure that predates and outlasts any provider-side fix, because the ciphertext is already public and the paper shows it could be decoded.