The Opaque Reasoning Block Is Both a Leak and an Injection Channel

The encrypted reasoning objects that OpenAI, Anthropic and Google use to carry hidden chain-of-thought between API calls turned out to be portable: a block created in one session could be replayed into another, and during testing handed to a weaker model in the same provider family, which transcribed the hidden content ^{[1] [2]}. That makes two problems at once. Anyone who published raw agent logs published whatever their model was thinking, and anyone who accepts an opaque reasoning blob from an untrusted source is accepting instructions they cannot read.

The paper, "Stealing Reasoning Traces from Proprietary LLM APIs," demonstrated four abuse paths: stealing proprietary reasoning for distillation, extracting private data from other users' published traces, recovering harmful content hidden behind a safe visible answer, and hiding prompt injections inside opaque reasoning blocks ^[3]. Across 6,708 public agent trajectories the team decoded 315,320 thinking blocks, roughly 47 per trajectory ^{[4] [5]}. After excluding benchmark sources, it counted 704 distinct privacy artifacts from genuine user sessions, including 62 API keys, 33 passwords, 24 access tokens and seven private keys ^[6]. That is 126 credential-shaped items, about 18 percent of the non-benchmark total ^[7].

The detail that should worry anyone running a sanitisation step: 64 of those 704 artifacts appeared only in hidden reasoning and nowhere in the visible trace ^[8]. Scrubbing the readable conversation leaves the secret sitting inside a block another account can replay ^[9].

Nothing was cracked. No encryption key was obtained; the attack relied on intact opaque blocks being accepted and processed by the provider ^[10]. The three designs differ only in packaging - OpenAI returns encrypted reasoning items for manually managed history, Anthropic carries reasoning in an encrypted signature, Google uses encrypted thought signatures ^[11]. The named decoders were Claude Haiku 4.5 for Claude traces, GPT-5.6 Luna for GPT traces and Gemini Robotics ER-1.6 for Gemini traces, prompted to transcribe a stronger sibling's reasoning ^[12].

The injection proof of concept is the more durable lesson. The team built an opaque reasoning block carrying a malicious instruction, replayed it into an unrelated task, and the receiving model added an attacker-directed upload action with the instruction never appearing in visible text ^[13].

Scope, honestly stated: the cross-user attack gave no arbitrary access to private chats, and required both an encrypted block, such as one in a published agent log, and API access to a compatible model from the same provider ^[14]. The exposure lands on developers who shipped raw logs with reasoning objects intact ^[15]. The authors also concede they have no ground-truth plaintext, so fidelity rests on reasoning-token counts and qualitative comparison ^[16]. No malicious exploitation in the wild is documented ^[17].

The researchers disclosed to the affected providers, Microsoft and Hugging Face, and say the demonstrated attacks stopped working after mitigations, with the main extraction attack no longer reproducible as of August 2026 ^[18]. Encrypted reasoning is still in the APIs; handling changed ^[19]. OpenAI still tells developers to replay encrypted reasoning items when managing stateless history ^[20], Google says its backend manages thought compatibility across model switches ^[21], and Anthropic now says thinking blocks are tied to the model that produced them ^[22].

Watch whether anyone treats reasoning blobs as untrusted input at the point of ingestion rather than relying on provider-side binding. The advice for now is mechanical: strip reasoning blocks and opaque reasoning fields from shared traces, and do not commit raw API transcripts even after the visible text is clean ^[23].