Researchers Show Encrypted Reasoning Blocks From OpenAI, Anthropic and Google Can Be Decrypted Using a Weaker Sibling Model

Set `include` to `["reasoning.encrypted_content"]` and the trace comes back inside the response body, as an output item of type `reasoning` carrying an id and an `encrypted_content` string ^[8][10]. From there it travels wherever response bodies travel in your stack: HTTP access logs, transcript tables, cached conversations, committed test fixtures. The same example request sets `store: false` ^[8]. That governs the provider's copy, and your side keeps whatever your retention policy keeps.

The post describes those blocks as opaque base64 blobs, inaccessible to the caller ^[18]. So the caller holds the ciphertext and the provider holds the key. If the key management fails later, the failure reaches backwards through everything already stored.

On the money: the writeup puts the cost of decoding 10,000 traces at roughly $720 ^[4], which is about 7.2 cents each ^[14]. Against the 315,320 encrypted blocks it says have already been scraped from public GitHub and Hugging Face repositories ^[6], the full corpus prices out near $22,700 ^[15]. For 7.2 cents to transfer to your traces, the oracle's cost per trace has to hold at your trace length. The example in the post asks for medium reasoning effort ^[9]. A trace generated at high effort is longer, and an attack billed per token of oracle inference scales with the length of what it is decoding.

The whole account rests on one dev.to post, which reports the paper as published on August 11, 2026 at arxiv.org/abs/2608.09867, with a vanity domain at stolen-thoughts.com ^[1][2]. The vanity domain is a publicity choice. The post says the three providers silently patched the core vector before publication ^[5], a claim a caller cannot check from outside. Its example request names the model `gpt-5.6-luna`, and its background section lists Claude Opus, Haiku and Fable alongside GPT-5.x and Gemini 3.x ^[9][13]. Those model names are worth resolving against a provider's own model list before anyone reprices a threat model on this.

Where the ciphertext sits does not depend on the paper being right. The reason the field exists is multi-turn: the model can reference its own prior reasoning when you hand the block back on the next call ^[17]. Anything beyond that round trip is retention you chose. Strip `encrypted_content` before responses reach a log sink, and check the fixtures too, because per the post 315,320 of these blocks are already sitting in public repositories ^[6].

The described attack itself is a key management flaw shared across all three providers, decrypting an extended thinking block by using a weaker sibling model as an unwitting oracle ^[3]. A caller cannot patch an oracle built from a cheaper model in the same family; it is reachable by anyone with an API key and the ciphertext.