Encrypted reasoning traces are decodable, and 315,320 harvested blocks yielded 367 PII artifacts and 182 credentials.

arXiv 2608.09867, from a team including Ilia Shumailov, Jonas Geiping, and Maksym Andriushchenko, found the encrypted reasoning blocks Anthropic, OpenAI, and Google return via API are fully interchangeable across sessions, users, and models within each provider's ecosystem. Inject a trace from a capable model into a weaker, less-safeguarded variant, and it decodes to plaintext. They scraped the blocks from public GitHub repos. If you've ever committed a raw API response containing an encrypted reasoning block, you've leaked the chain of thought and whatever was in it.