AINEWS
The 'encryption' on a reasoning AI's hidden 'thinking' step is locked to the AI company's whole product line, not to the specific AI that produced it. So a cheaper AI from the same company can be told to read it out anyway.
An API key. A password. A personal email address, a passport number, a credit card with its CVV. All sitting inside the "encrypted" thinking block of a frontier AI, never in the visible answer, never in the chat log. A research team pulled 64 secrets like them out of public agent sessions at OpenAI, Anthropic, and Google, by routing the encrypted block through a weaker sibling model from the same vendor. The strong model was never touched.
The team behind the paper on arXiv (2608.09867) and the artifact site at stolen-thoughts.com calls the technique a cross-model decoding attack. It works because the "encryption" on a reasoning API's hidden block is keyed to the model family, not to the producing model. Take a strong model's encrypted reasoning trace, inject it into a weaker sibling from the same provider with a "transcribe verbatim" instruction, and the weaker model hands back the strong model's hidden reasoning in plaintext. No cipher is broken. The architectural choice is the vulnerability.
When a developer calls OpenAI, Anthropic, or Google's reasoning endpoint with a prompt, the model runs a hidden "thinking" step before the visible answer. That step is what the industry calls a chain-of-thought: an internal scratchpad where the model plans, checks itself, and sometimes pulls in tools. The API returns that scratchpad to the client alongside the answer, and the API labels it encrypted. The labels are accurate. The keys are not what most readers would assume.
The paper documents four working attack vectors that follow from that keying choice:
The researchers scraped 6,708 public agent trajectories from GitHub and Hugging Face, sessions shared by developers using Claude, GPT, and Gemini, and ran the decoding pipeline against every signed block. They reconstructed 315,320 reasoning blocks. Inside the genuine, non-benchmark sessions, they recovered 704 distinct privacy artifacts:
ghp_ prefix, and Hugging Face tokens with the hf_ prefixAccording to the project site, 64 of those artifacts appeared only inside the hidden reasoning block and nowhere in the visible session. A user could delete the secret from the chat log, and the model would still have echoed it into the "encrypted" block the API ships to the client. The decoding attack then lifts it from that block.
The team also checked the decoded reasoning length against the hidden thinking-token count the API reports. On a 120-problem Codeforces sample, the two tracked each other closely: independent confirmation that what comes back from the sibling model is the source model's actual hidden thinking, not a hallucinated rewrite.
The arXiv listing names nine authors across MATS Research, the ELLIS Institute Tübingen, the Max Planck Institute for Intelligent Systems, the Tübingen AI Center, Snyk, and the University of Tübingen. The paper carries a 2026 date and the title "Stealing Reasoning Traces from Proprietary LLM APIs." A Hacker News thread collects community reaction; no provider-issued safety bulletin or CVE is on the record at writing.
The authors propose two mitigations: cryptographically bind the reasoning block to the user, session, and producing model, so a sibling model cannot transcribe it; and add system-level controls that detect and refuse the injection. The attack fails if any vendor adopts the binding. Until one does, the practical posture is the one the artifact count already suggests: treat a publicly shared agent trace from a reasoning API as if the hidden block will be readable, because for all three current frontier vendors, it can be.