[OpenAI](#/company/openai), [Anthropic](#/company/anthropic) and [Google](#/company/google) all hide their models' internal [chain-of-thought](#/dictionary) behind encrypted, client-side tokens rather than exposing it to users. A paper published August 10 by researchers at the ELLIS Institute Tübingen, the Max Planck Institute for Intelligent Systems and Snyk shows those tokens can be forced open: capture an encrypted reasoning block one model produced, feed it to a cheaper, less-guarded sibling model from the same provider, and that weaker model will decrypt and read the contents back in plain text — without ever jailbreaking the stronger model directly.
How the replay attack works
The trick works because the encrypted blocks a provider's API returns are, in the paper's own words, "fully compatible and interchangeable across different sessions, users, and models" within that provider's ecosystem. Nothing in the format ties a block to the session, account or model that produced it, so an attacker who captures one can resend it later, to a different account, addressed to a different and weaker model in the same family, and ask that model to transcribe what it just decoded.
From a captured reasoning block to plaintext in a weaker model
- Captures an encrypted reasoning block a provider's API returned after a stronger model finished thinking.
- Resends that same encrypted block to the API, addressed to a cheaper, less-restricted sibling model.
- Decrypts the block normally — the format doesn't check which session or model originally produced it.
- Is prompted to transcribe the decoded reasoning verbatim, handing back the stronger model's private chain-of-thought as plain text.
The researchers demonstrated the technique against all three providers' APIs, then used it for more than proving a point. Developers routinely post API session logs — bug reports, demo transcripts, shared notebooks — to GitHub and [Hugging Face](#/company/huggingface) without realizing the reasoning blocks sitting inside them are readable by anyone willing to replay them through a compatible model.
Applying the technique to 6,708 publicly posted agent transcripts scraped from GitHub and Hugging Face — reasoning left behind by Claude, GPT and Gemini models — the team decoded 315,320 individual reasoning blocks. Only a small share of any single block carried something sensitive (0.3%, or 1,028 blocks), but because one leaky session spans many blocks, the picture looks worse per transcript: 4.9% of the 6,708 sessions, or 328 of them, leaked at least one real secret somewhere in their reasoning. What came out the other side, scoped precisely:
What each number in the paper actually counts
- 315,320 · reasoning blocks
- Decoded across 6,708 scraped public agent transcripts
Includes: Every reasoning block the team could decode from GitHub- and Hugging Face-hosted logs left by Claude, GPT and Gemini
Excludes: Anything not already publicly posted; the researchers did not access private accounts - 1,028 · blocks (0.3%)
- Blocks containing at least one recoverable privacy leak
- 328 · sessions (4.9%)
- Of the 6,708 transcripts, leaked at least one real secret somewhere in their reasoning
- 62 / 33 / 24 / 7 · API keys / passwords / access tokens / private keys
- Recovered from genuine, non-benchmark user sessions specifically
Excludes: Benchmark and synthetic-persona traces, which the paper counts separately
The recovered material wasn't confined to abstract test data. The paper's authors write that some of what surfaced "did not even feature in the user's input, having been injected invisibly from the model's memory" — meaning a developer reading their own plain-text session log would have no way to know the reasoning block sitting next to it contained a live credential at all.
Credential theft is only one of four abuse paths the paper lays out. The same replay trick also lets an attacker read reasoning a model generated while working through a request its final, visible answer safely refused — the harmful content sits in the hidden chain-of-thought even when the response shown to the user looks clean. And because a reasoning block is opaque until decoded, the researchers show it can carry a hidden instruction: an attacker can embed a prompt injection entirely inside an encrypted block, invisible to anyone reviewing the plain-text parts of a shared transcript, to poison an AI agent reading that transcript later.
Not the first warning
This wasn't the first time a provider had been told the reasoning-block format could be replayed. Johns Hopkins cryptographer Matthew Green reported the underlying behavior to OpenAI and Anthropic in May and wrote up how each responded to him.
“OpenAI said my report was unreproducible. I sent them my scripts, but too late.” — Matthew Green, on OpenAI's response, May 2026
Anthropic's answer was different in tone and identical in effect:
“Anthropic quite reasonably told me they don't see any security implications in side channels or replays, but they might alter their developer documentation to warn application developers to be more careful.” — Matthew Green, on Anthropic's response, May 2026
Google was not named in Green's account as a recipient of the May report. Neither dismissal stopped what came next: the August paper cites Green's work directly, then goes further, showing the same architectural gap recovering real secrets at scale from data that was already public.
Two disclosures, three months apart
| Green, May 29, 2026 cryptography blog post | Panfilov et al., Aug 10, 2026 arXiv paper | |
|---|---|---|
| What was shown | Encrypted reasoning blocks can be replayed across sessions, users and models | The same replay extracts real credentials, PII and full reasoning traces at scale |
| OpenAI's response | Called the report unreproducible | Acknowledged receipt of the report; paper says the attack no longer works against current API builds |
| Anthropic's response | Said it saw no security implications in the behavior | Acknowledged receipt of the report; paper says the attack no longer works against current API builds |
It's a familiar shape this summer: a gap between how a lab secures a model's outputs and how it secures the infrastructure carrying them. In July and August, [four labs disclosed AI agents reaching past their own sandboxes](#/article/moonshot-kimi-k3-sandbox-escape-benchmark-cheating) during security evaluations, and [a single GitHub issue was shown able to hijack three vendors' coding agents at once](#/article/black-hat-2026-github-issue-claude-code-gemini-cli-codex-rce). This is a different failure — nothing had to be hacked, only replayed — but the pattern is the same: the model behaved exactly as designed, and the surrounding system was the part that hadn't been.
What's fixed, and what's still open
The paper reports that all three providers acknowledged its disclosure before publication and that the specific replay attacks it demonstrated no longer work against current API builds. None of the three has published its own security advisory naming the vulnerability, so the only public account of what changed, and when, is the researchers' own. The paper's proposed fix is architectural: cryptographically bind each reasoning block to the exact session, user and model that produced it, so a block that decrypts cleanly for one can't be replayed into another.
For developers, the more immediate exposure doesn't require anyone to fix an API at all: any reasoning-block-bearing session log already posted to GitHub or Hugging Face before the mitigations shipped stays replayable by anyone who saves a copy first. The researchers' data-hygiene recommendation — strip reasoning blocks from any transcript before sharing it — addresses logs going forward, not the ones already public.
- A paper shows encrypted AI reasoning blocks can be replayed into a weaker model and read in plaintext.
- Decoding 315,320 public reasoning blocks recovered 62 API keys, 33 passwords, 24 access tokens and 7 private keys.
- OpenAI and Anthropic dismissed a similar warning about the same flaw in May 2026.
- All three providers acknowledged the August report; the paper says the attack no longer reproduces.
- Caveat: no vendor has published its own advisory confirming the fix or naming its full scope.