Vulnerability Exposed: Stealing AI Reasoning Traces from Encrypted API Blocks
Researchers decrypt proprietary LLM reasoning chains, exposing four critical security risks.
1The Hidden Vulnerability
Researchers discovered a critical flaw in how major AI providers like Anthropic, OpenAI, and Google handle reasoning traces. Instead of keeping these step-by-step thought processes server-side, they're sent to clients as encrypted blocks. This architectural decision creates an unexpected vulnerability where these encrypted blocks remain interchangeable across different sessions, users, and even models within the same provider's ecosystem. The compatibility allows attackers to manipulate the system by injecting these blocks into less secure models.
2The Decryption Jailbreak Technique
The attack works by taking an encrypted reasoning trace from a powerful model and injecting it into a weaker model from the same provider. The weaker model is forced to decode and output the trace in plaintext, effectively bypassing the security of the more capable model. This method doesn't require directly jailbreaking the stronger AI, making it particularly insidious. The technique was successfully demonstrated across multiple leading AI providers, showing it's not an isolated issue but a systemic vulnerability in current implementations.
3Four Major Attack Vectors
The vulnerability enables four distinct types of attacks: 1) Circumventing anti-distillation to steal proprietary reasoning methods, 2) Large-scale private data extraction from public repositories (researchers recovered 367 PII artifacts and 182 credentials from 315,320 blocks), 3) Revealing hazardous information hidden in reasoning traces even when final outputs appear safe, and 4) Executing invisible prompt injections by embedding malicious payloads entirely within encrypted blocks.
4Real-World Data Breach Example
In a startling demonstration, researchers analyzed 315,320 reasoning blocks scraped from public repositories where developers had unknowingly shared session logs containing encrypted data. From these, they successfully extracted 367 pieces of personally identifiable information (PII) and 182 credentials. This shows how the vulnerability enables large-scale data leaks without direct system breaches, as developers may inadvertently expose sensitive information while sharing what they believe to be harmless logs.
5Hidden Dangers in Rejected Outputs
Even when AI systems properly reject malicious requests in their final output, dangerous information may still be present in the reasoning traces. The research found cases where hazardous data appeared in the encrypted reasoning blocks while the visible output correctly refused the request. This creates a blind spot where harmful content could be extracted despite apparent safeguards, potentially exposing sensitive information or dangerous instructions.
6Invisible Prompt Injection Threat
Attackers can exploit this flaw to conduct completely hidden prompt injections. By embedding malicious payloads entirely within encrypted reasoning blocks, they can poison public agentic rollouts without detection. This method bypasses traditional security checks that only monitor visible inputs and outputs, creating a new class of vulnerabilities in AI systems that rely on chain-of-thought processing.
7Provider Responses and Mitigations
Following responsible disclosure, researchers proposed concrete cryptographic and system-level solutions to secure client-side reasoning. These include implementing proper session binding for encrypted blocks, adding integrity checks, and reconsidering the architectural decision to send reasoning traces to clients. The findings have prompted urgent reviews at affected AI companies, though implementing fixes may require significant changes to existing API architectures.
8Implications for AI Security
This research fundamentally changes how we must approach AI security. It reveals that protecting final outputs isn't enough - the entire reasoning process must be secured. The findings impact all providers using chain-of-thought architectures and will likely lead to new security standards for AI systems. As AI becomes more agentic and autonomous, securing these reasoning traces becomes critical to prevent large-scale data leaks and system manipulations.