315,320 Encrypted Reasoning Blobs In Public Repos Yielded 549 Secrets

The number is 315,320: the count of encrypted reasoning blocks that the authors of an arXiv preprint scraped from public repositories and decoded, recovering 367 personally identifiable information artifacts and 182 credentials ^[5]. That is 549 sensitive artifacts ^[1], or about one per 574 blocks ^[2], and one credential for every 1,733 blocks ^[3].

The figure exists because of an architectural choice. Anthropic, OpenAI and Google stopped returning plaintext chain-of-thought and now hand the client an opaque encrypted block that the client must pass back with every subsequent request, avoiding server-side state ^[1]. On Anthropic's API that arrives as a `signature` field on each thinking block, an encrypted copy of the full reasoning that you return unchanged ^[9]. On the newest models the human-readable summary defaults to omitted, so the block ships with an empty `thinking` field while still being billed and passed back identically ^[10]. You are storing the reasoning either way; you just cannot read it.

That is how it ends up committed. Developers publish session logs without knowing what the encrypted blocks contain ^[6], and those traces carry intermediate hypotheses, tool outputs, user data and contextual secrets ^[7]. Volume compounds it: a single response can run from a few hundred to tens of thousands of reasoning tokens ^[11], and GPT-5.6 models default to rendering reasoning from earlier turns into later ones ^[12].

The decode is the part that changes the threat model. The paper reports that the blocks are interchangeable across sessions, users and models inside one provider's ecosystem ^[2], so a trace from a hardened frontier model can be injected into a cheaper sibling such as Claude Haiku 4.5 or GPT-5.6 Luna, which lack the same anti-distillation defenses ^[8] and will emit it verbatim in plaintext ^[3]. The authors demonstrate this across all three providers ^[4].

Two knock-ons for anyone shipping agents: hazardous content can sit in the trace even when the visible answer refuses ^[14], and a payload hidden entirely inside an encrypted block can poison public agentic rollouts used as fixtures ^[13].