The scope of a key is a design decision, and this one was made against a requirement nobody appears to have written down. The stated need is continuity: the client holds an opaque block and hands it back so a later turn can build on earlier reasoning, with the server keeping the only keys [2]. A key bound to one session, or one paying customer, meets that need in full. What the summary describes instead is a single logical scheme spanning all models, all sessions and all users inside a provider [4], so that a token minted by ChatGPT is readable by GPT-3.5 and a Claude Instant token is readable by Claude 3 [5]. The distance between what continuity requires and what the system grants is the whole vulnerability [2].
Cipher strength is not the variable under test. The cheaper model opens the token as part of ordinary processing [6], it carries thinner output safeguards and refuses less [7], and the frontier model is never approached at all [9]. Confidentiality therefore settles at the level of the most compliant model sharing the scheme [1], and that model is sold at retail to anyone with a card [8], which puts the attacker's budget at list price for the weakest sibling [3].
Be precise about the evidence. This is a plain-English summary published on dev.to of a paper carrying the same title, and the material supplied names no authors, no venue, no reproduction detail and no reply from any vendor [10]. The companies said to ship visible reasoning, OpenAI through o1, Anthropic through extended thinking, Google through its reasoning variants, are named by the summary rather than speaking for themselves here [1]. So this is a claim about architecture, testable by asking a vendor what the key scope actually is, not a demonstrated exploit with a tracking number.
It is still the right question to ask, because of what the encryption is being sold as. Hidden reasoning is positioned as an asset worth guarding: competitors want to see how frontier models think, and the summary is blunt that attackers want the proprietary algorithms inside [11]. A buyer who accepted that framing bought a promise that the trace is unreadable outside the vendor. If the tokens are interchangeable across the family by design [5], the promise shrinks to something narrower, that the trace is unreadable in the product you happen to be paying for. Those are not the same guarantee, and only one of them survives a competitor opening an account on the entry tier.
The repair is unglamorous. Narrow the key to a session or a tenant, accept that a reasoning block minted by one model no longer travels to another, and lose the convenience of free-flowing context inside the family [2]. That cost lands on the vendor's engineering, not on the customer's continuity, which is why the current arrangement reads less like a security tradeoff than like an integration shortcut that was never priced as one.
