Researchers have shown that encrypted reasoning traces—tiny packets a provider sends to a user’s device so a conversation can hop between models—can be decrypted by a weaker model from the same service, spilling hundreds of credentials and private details. The finding, detailed in the paper Stealing Reasoning Traces from Proprietary LLM APIs, threatens a convenience feature that Anthropic, OpenAI and Google rely on to keep AI chats smooth.

Why the encrypted blocks exist

When you talk to a large language model (LLM), the service builds up a “reasoning trace”: the chain of internal prompts, tool calls and chain-of-thought steps that led to the answer. To let you change from a larger model to a cheaper one without losing that chain, providers encrypt the trace, ship it to your device, and expect you to send it back with the next request. The encryption is meant to keep the trace private while still enabling cross-session, cross-model continuity.

How the attack works

The researchers demonstrated a three-step exploit that needs no breach of the strong model itself:

  1. Capture an encrypted reasoning block generated by a powerful model during a normal conversation.
  2. Feed that block to a weaker model from the same provider, asking it to “read” the block.
  3. Because the weaker model shares the same decryption keys, it outputs the decrypted content in plain text.

The weaker model acts as a decryption oracle. The attackers never touched the strong model’s internals; they simply used the provider’s own API against itself.

What the researchers recovered

  • 182 credentials – API keys, tokens and other secrets embedded in the trace.
  • 367 pieces of private information – names, emails, addresses that users had supplied during the chat.
  • Prompt-injection payloads – malicious instructions hidden in the encrypted block that could later be executed when the trace is replayed.
  • Safety-filter bypasses – the decrypted trace revealed steps that would have been blocked if examined in plain text, allowing hazardous content to slip through.

The paper stresses that the weakness is not a flaw in the cryptographic algorithm; the encryption itself holds up. The breach stems from the design choice to let any model in the provider’s fleet decrypt the block for the sake of user experience.

The trade-off at the heart of the issue

Providers built this “model-switching” capability into their APIs because developers and end-users value continuity. If the encryption tied to a single model instance or session, the smooth hand-off would break, forcing developers to rebuild state management themselves. The paper argues that security was deliberately sacrificed for flexibility.

What developers should do now

  • Treat encrypted traces as clear-text. Assume any log, cache or monitoring system that stores them could be read by an attacker.
  • Avoid committing traces to public repositories. Even a single stray block can expose dozens of secrets.
  • Plan for tighter controls. Providers may tighten security, which could change the way multi-model agents are built.
  • Shift to explicit state hand-offs. Instead of relying on hidden reasoning, design agents to output structured data (JSON, XML, etc.) that can be safely passed between models without encryption.
  • Audit your prompts. Look for any sensitive data that ends up in the reasoning chain and strip it out before sending the request.

What to watch from the big providers

The paper’s release will push Anthropic, OpenAI and Google to reassess the decryption policy baked into their APIs.

The broader implication

The discovery underscores a classic security dilemma: convenience often opens a backdoor. By allowing any model to decrypt a user-owned block, providers have handed attackers a low-effort path to sensitive data. The fix will likely make AI integrations a bit more cumbersome, but it will also restore the expectation that encrypted data stays encrypted.

Takeaway: Encrypted reasoning traces are not a security boundary; they are a convenience shortcut that can be turned against you. Treat them as plain text, purge them from logs, and redesign your agents to survive a future where only the originating model can read its own thoughts.