A research team including Alexander Panfilov, Jonas Geiping and Maksym Andriushchenko reports that encrypted reasoning blocks returned by proprietary APIs are fully interchangeable across sessions, users, and models within the same provider's ecosystem.

Because weaker sibling models like Claude Haiku 4.5 or GPT-5.6 Luna lack the strict anti-distillation safeguards of frontier models like Opus 4.8 or GPT-5.6 Sol, an attacker can inject an encrypted trace from the strong model into the weak one and make it transcribe the hidden reasoning in plaintext — a 'decryption jailbreak' that never touches the frontier model directly.

The authors say they demonstrated the attack across OpenAI, Google, and Anthropic.

The labs introduced encrypted chains of thought specifically to protect intellectual property and limit leakage, replacing the plaintext reasoning they deprecated in 2026.

The paper's threat model assumes nothing more than a standard, unprivileged API user — no insider access, no server-side visibility, no model weights.

That the design itself creates a decryption oracle inside each provider's own model family is a reversal of the mechanism's stated purpose: the safeguard becomes the attack surface, and the smaller, cheaper model becomes an unwitting decoder that bypasses the frontier model's alignment entirely.

The paper details four attack vectors: distillation of proprietary reasoning, extraction of credentials and personal data from published traces, hidden prompt injection through poisoned encrypted blocks, and jailbreaking via the hidden reasoning channel.

Scraping 315,320 reasoning blocks from public repositories, the researchers recovered 367 personally identifiable information artifacts and 182 credentials — including 62 API keys, 33 passwords, and 30 personal emails from genuine user sessions.

Developers frequently share session logs publicly, unaware of what the opaque encrypted blocks contain, and some recovered data bypassed sanitization because users could not read it before sharing. The paper follows responsible disclosure and proposes cryptographic and system-level mitigations.

The findings land as AI tooling is already leaking secrets in other ways: OpenTools reports that security firm Apiiro found Claude Code's 'don't ask again' feature stores passwords, API keys, and SSH logins in plain text in a local settings file, with over 1,000 copies ending up in public GitHub repositories and 2,539 secrets exposed — an issue Anthropic's Claude Code lead acknowledged.

Combined with the new paper, the pattern suggests opaque machine-readable outputs are becoming a recurring blind spot for both vendors and users.

What comes next is largely on the vendors: the researchers leave concrete cryptographic and system-level mitigations for securing client-side reasoning, and the attack vectors — distillation, invisible prompt injections, and hidden hazardous information — remain until providers change how encrypted traces are scoped and verified.