Encrypted AI Reasoning Data Can Be Recovered, and Shared Session Files May Leak Secrets

A recently published paper, "Stealing Reasoning Traces from Proprietary LLM APIs", describes a way to recover the hidden reasoning that AI models produce. Providers such as OpenAI and Anthropic pass this reasoning back and forth inside an encrypted blob. The researchers replayed that blob to a less capable model that is easier to jailbreak, and convinced it to reveal the underlying reasoning. This appears possible because providers likely use shared encryption keys across users, sessions and models. Earlier work by Matthew Green had already shown that these blobs can be replayed across sessions, accounts and, for OpenAI, even across models.

The researchers tested the risk at scale. They decoded 315,320 reasoning blocks scraped from public repositories and recovered 367 pieces of personal information and 182 credentials, including API keys and passwords. The risk is that people may share session files without realising what is stored inside those encrypted blobs.

The author of the source article also built tooling to test the attack against an OpenAI model and found it worked, including across models, sessions and separate accounts. The output was not always a word-for-word copy of the original reasoning, but it clearly recovered substantial meaning from the encrypted trace. Encrypted reasoning blobs should not be treated as harmless.