IMPLICATOR
Late in May 2026, Matthew Green, a cryptographer at Johns Hopkins University, replayed the same encrypted reasoning blocks across API calls, sessions and accounts. He reported the behavior through bug-bounty channels, then published his findings.
The blocks still worked outside the conversations that created them.
A preprint submitted on August 10, 2026, carries that experiment into Anthropic, OpenAI and Google’s commercial APIs. Its authors decoded 315,320 reasoning blocks taken from 6,708 agent trajectories that users had already posted publicly, then catalogued the private material caught inside.
What Changed
- Researchers decoded 315,320 encrypted reasoning blocks from 6,708 public agent trajectories shared online.
- Genuine user sessions yielded 704 privacy artifacts, including 62 API keys, 33 passwords and 24 access tokens.
- The attack replayed intact blocks into compatible weaker models; it did not crack encryption or access provider infrastructure.
- Providers mitigated the reported method before publication, and the paper says it no longer reproduced in August 2026.
AI-generated summary, reviewed by an editor. More on our AI guidelines.
The sealed envelope
A reasoning model works through intermediate steps before presenting its answer. Providers often keep those steps out of sight to protect proprietary methods and prevent raw, sometimes unsafe, internal text from reaching users. Yet stateless APIs need a way to preserve that work between calls.
The result is much like a sealed envelope. The provider hands an encrypted block to the client for safekeeping and expects the same block back on the next turn. The client cannot read or edit it, but the model can open it and continue from the earlier reasoning.
Green established that the envelope was portable. “We can replay an unmodified older reasoning blocks, with no visible error at all,” he wrote after his May 2026 tests. His work showed cross-session and cross-account replay, but stopped short of a dependable method for extracting secrets.
Alexander Panfilov, a computer scientist affiliated with the ELLIS Institute Tübingen and the Max Planck Institute for Intelligent Systems, helped extend that finding as a coauthor of the new paper. The equal-contribution author order was decided by dice roll. The team found that an intact block produced by one model could, during its July 2026 tests, be accepted by another compatible model from the same provider. A compatible, less protected model processed the intact encrypted block as prior reasoning and followed a request to transcribe that reasoning.
That did not break the encryption. The method required possession of a valid block, such as one left in a public agent log, plus ordinary API access to a compatible model from the same company. It did not open arbitrary private chats, expose a provider’s keys or enter its infrastructure.
What the logs held
The researchers collected 6,708 public agent trajectories from GitHub and Hugging Face and applied their decoding pipeline to 315,320 signed blocks. The team flagged 1,028 blocks, or 0.3% of the August 2026 sample, as containing at least one potential privacy leak. At the trajectory level, 328 sessions, or 4.9% of the sample, exposed at least one real sensitive item.
After removing benchmark data, the researchers counted 704 distinct privacy artifacts in genuine user sessions. That August 2026 tally included 62 API keys, 33 passwords, 24 access tokens, seven private keys and 30 personal email addresses. Sixty-four of the 704 artifacts appeared only in hidden reasoning, not in the visible chat history.
Get Implicator.ai in your inbox
Strategic AI news from San Francisco. No hype, no "AI will change everything" throat clearing. Just what moved, who won, and why it matters. Daily at 6am PST.
No spam. Unsubscribe anytime.
A model asked to clean a conversation may restate the sensitive values in reasoning while removing them from the readable text. The user can inspect the scrubbed conversation but cannot inspect the encrypted block attached to it.
The evidence does not cover private chats generally. The public-log scan was non-exhaustive, and the paper documents no malicious exploitation in the wild.
The missing plaintext
The paper calls the recovered material reasoning, but the researchers could not compare it with ground-truth plaintext from the proprietary models. Their fidelity test instead compared reconstructed text with API-reported thinking-token counts across 120 Codeforces problems during the 2026 study. API billing reports the source model’s thinking-token count, so a reconstructed trace of closely matching length suggests that little material was omitted. The reconstructed lengths generally tracked the reported counts, and qualitative checks found more detail than the summaries providers displayed.
Know someone who'd find this useful? ✉️ Email it to a friend in one click, or they can subscribe free here.
That is evidence of close reconstruction, not proof that every recovered word matched the original trace. Decoder models generate text probabilistically, and the providers’ cryptographic systems remain private. The paper is also a first-version preprint, not a peer-reviewed finding.
The study cost the team about $30,000 in API credits through August 2026. Panfilov’s group used that spending to test several model families and examine privacy artifacts at scale, but its central demonstration depended on API behavior that providers could change without public notice.
The providers respond
The researchers disclosed their findings to the three model providers, Microsoft and Hugging Face before publication. Each provider acknowledged receiving the report, and the team later could no longer reproduce the same attacks. The paper’s reproducibility statement says the main extraction method no longer worked as of August 2026 because providers had installed mitigations.
Michael Aciman, an Anthropic spokesperson, said the company had begun deploying short-term protections against the replay behavior. He also said the research did not obtain Anthropic’s encryption keys or access its infrastructure. Anthropic’s current documentation says thinking blocks are tied to the model that created them and should be removed when switching models because other models will ignore them.
OpenAI still documents encrypted reasoning items as a way to preserve context when developers manually manage stateless histories. That continuing feature explains why clients retain opaque blocks, but it does not show that the paper’s old extraction method remains available.
The authors proposed binding each block to its original user, conversation and model, or keeping reasoning on the provider’s servers and returning only an identifier. Those changes would reduce portability, but they could complicate model switching and require more storage. The paper closes with a question the mitigations do not settle: whether providers should continue returning encrypted reasoning traces to clients at all.
Frequently Asked Questions
What is an encrypted reasoning block?
It is an opaque package containing a model’s intermediate reasoning. A stateless API gives the block to the client, which returns it on a later turn so the model can continue from its earlier work.
Did the researchers break the providers’ encryption?
No. They used valid blocks that compatible models accepted outside their original context. The method did not reveal provider keys, enter company infrastructure or grant access to arbitrary private chats.
What did the researchers find in public agent logs?
They decoded 315,320 blocks from 6,708 trajectories. Genuine user sessions contained 704 distinct privacy artifacts, including 62 API keys, 33 passwords, 24 access tokens, seven private keys and 30 personal email addresses.
Can the same extraction attack still be reproduced?
The paper says no. Anthropic, OpenAI and Google acknowledged the disclosure, and the researchers reported that the demonstrated extraction stopped working after provider mitigations by August 2026.
Why do API clients hold reasoning blocks?
The blocks let stateless APIs preserve a model’s intermediate work without keeping the full reasoning state on the provider’s servers. The paper proposes binding each block to its user, conversation and model, or returning only a server-side identifier.
AI-generated summary, reviewed by an editor. More on our AI guidelines.
Marcus Schuler
Editor-in-Chief and founder of Implicator.ai. Former ARD correspondent and senior broadcast journalist with 10+ years covering tech. Writes daily briefings on policy and market developments. Based in San Francisco. E-mail: editor@implicator.ai
