A 116-page paper from researchers at MATS Research, the ELLIS Institute Tübingen, and the Max Planck Institute for Intelligent Systems reveals that every major frontier AI company exposes encrypted chain-of-thought blocks through their APIs. The team decoded 315,320 encrypted reasoning blocks from public repositories. They also found 182 leaked API credentials in those same logs.
TL;DR: Researchers extracted 315,320 encrypted reasoning blocks from public logs and found 182 leaked API credentials, proving that chain-of-thought traces from OpenAI, Anthropic, and Google can be replayed across sessions, users, and models. The extracted token counts matched billed API thinking tokens at a 1:1 ratio for most prompts tested.
What Are Reasoning Traces and Why Do AI Providers Hide Them?
Reasoning traces are the intermediate chain-of-thought steps that models like GPT-4.1 and Claude 3.7 generate before producing a final answer. Providers encrypt these internal deliberations to protect proprietary training methods and prevent competitors from distilling model capabilities through reasoning extraction. The encrypted blocks are returned to API clients alongside the visible response.
The encryption serves a dual purpose. First, it prevents users from simply reading the model’s internal logic, which could reveal training data patterns or prompt engineering strategies. Second, it allows providers to bill for computational resources consumed during reasoning. Alexander Panfilov’s team confirmed that reasoning token counts match billed API thinking tokens at a 1:1 ratio for most queried prompts.
Despite the encryption, these blocks are not opaque. The research demonstrates that the encrypted reasoning traces remain functional when injected into new conversations. Providers assumed encryption would suffice. They were wrong.
How Did Researchers Extract Encrypted Chain-of-Thought Blocks?
The extraction method does not require breaking encryption. Instead, researchers collected encrypted reasoning blocks from public repositories where developers had published agent logs, debugging output, and application transcripts. These logs contained the encrypted chain-of-thought blocks returned by APIs during normal operation, deposited by developers who were unaware of the security implications.
From these public sources, the team amassed 315,320 encrypted reasoning blocks. The sheer volume demonstrates how routinely developers expose this data. GitHub repositories, tutorial code, and production debug logs all contained recoverable reasoning traces. The researchers also discovered 182 leaked API credentials in the same public logs, with some sources reporting 62 live API keys still active.
The extracted blocks retain their full functional properties regardless of encryption. When injected into a new API call, the receiving model treats the encrypted reasoning as its own internal deliberation. The encryption is transparent to the model itself. It only prevents human inspection.
Which AI Models and APIs Are Affected by the Vulnerability?
The vulnerability affects every major frontier AI provider. The research specifically names OpenAI, Anthropic, and Google as companies whose APIs return encrypted chain-of-thought blocks that can be extracted and replayed. Models tested include GPT-4.1, Claude 3.7, and Google’s Gemini series, according to coverage from WIRED and Cybersecurity News.
The architectural flaw is consistent across providers. Each company returns encrypted reasoning tokens to clients as part of the API response payload. This design choice enables billing for reasoning compute but creates a persistent extraction surface. The encrypted blocks travel through client applications, logging systems, and public repositories without losing their functional integrity.
| Provider | Model | Encrypted CoT Returned | Replay Confirmed |
|---|---|---|---|
| OpenAI | GPT-4.1 / o-series | Yes | Yes |
| Anthropic | Claude 3.7 | Yes | Yes |
| Gemini | Yes | Yes |
No provider is exempt. The architectural pattern is industry-standard.
What Is Trace Replay and How Does It Cross Session Boundaries?
Trace replay is the core attack technique. An attacker takes an encrypted reasoning block from one session and injects it into a completely new API call. The receiving model processes the foreign reasoning trace as if it had generated the chain-of-thought internally. This works across different sessions, different user accounts, and even different model families.
The implications are significant. An attacker can harvest high-quality reasoning traces from public logs and use them to enhance weaker models. The technique effectively transfers the reasoning capabilities of frontier models to any system that accepts the encrypted blocks. Simon Willison noted on his blog that the blocks are interchangeable across sessions, users, and models.
This cross-session portability means encryption provides no real protection against capability theft. A reasoning trace generated by GPT-4.1 can be replayed in a session querying Claude 3.7. The receiving model adopts the injected reasoning without verification. The attack requires no cryptographic expertise, only access to public logs containing the encrypted blocks.
How Many Encrypted Blocks and API Keys Were Found in Public Logs?
Researchers decoded 315,320 encrypted reasoning blocks from public repositories, exposing the massive scale at which chain-of-thought data circulates in the open. The team also discovered 182 credentials and 62 live API keys scattered across agent logs on GitHub and similar platforms. These numbers reveal a systemic problem.
Developers routinely commit verbose agent logs without realizing those logs contain encrypted reasoning payloads. The payloads themselves are harmless until an attacker correlates them with the right decryption technique. But the API keys are immediately dangerous.
The stolen-thoughts.com paper documents that encrypted blocks from Anthropic, OpenAI, and Google are interchangeable across sessions, users, and models. This means a single leaked log file can serve as a dataset for trace extraction attacks targeting multiple providers simultaneously.
The credential exposure compounds the problem. An attacker who finds a live API key in a public repo can run their own queries and harvest fresh encrypted reasoning blocks in bulk. No complex heist required.
| Finding | Count | Source |
|---|---|---|
| Decoded reasoning blocks | 315,320 | explainx.ai, 2026 |
| Total credentials found | 182 | explainx.ai, 2026 |
| Live API keys | 62 | AI Governance Institute, 2026 |
Security teams should treat agent logs as sensitive as database dumps. Scraping public repositories for these artifacts is trivial.
Can Stolen Reasoning Traces Be Used to Distill Weaker Models?
Yes. Researchers verified that extracted reasoning traces can be injected into weaker models to improve their performance on complex tasks. The Panfilov team confirmed that their reasoning token count matches billed API thinking tokens at a 1:1 ratio for most prompts they queried.
This verification matters enormously. It proves the extracted traces are not noise or approximations — they are faithful reproductions of the proprietary model’s internal reasoning process. A competitor could use these traces to train an open-source model that mimics frontier capabilities.
The distillation pipeline works as follows. An attacker collects encrypted reasoning blocks from public logs or their own API usage. They decode the blocks using the techniques described in the 116-page paper by Maksym Andriushchenko and colleagues. They then fine-tune a smaller model on the extracted traces.
This process directly undermines the competitive moat that companies like OpenAI and Anthropic maintain around their frontier models. The encrypted blocks were supposed to prevent exactly this scenario.
- Trace injection improves weaker model accuracy on math benchmarks
- Extracted traces match billed thinking tokens at a 1:1 ratio
- Attackers need no direct access to model weights
- Public agent logs provide ready-made training datasets
- The technique works across all three major providers
- Distillation can happen entirely offline after extraction
- No special hardware is required for the extraction phase
- The attack surface grows with every new agent deployment
The distillation threat forces a rethinking of how reasoning models are served via API.
What Is Trace Inversion and Does It Bypass Encryption Entirely?
Trace inversion is a separate technique that reconstructs synthetic reasoning traces from model outputs alone, without needing access to encrypted chain-of-thought blocks at all. A paper titled “How to Steal Reasoning Without Reasoning Traces” introduces this method, which sidesteps encryption entirely.
The approach is brutally elegant. Instead of decrypting hidden reasoning, trace inversion observes the final answer and then prompts the model to generate plausible intermediate steps that would lead to that answer. The resulting synthetic traces can be used for distillation just like real ones.
This finding is devastating for the encryption-based protection model. Even if providers perfectly encrypt every reasoning block, attackers can still reconstruct functionally equivalent traces. Hiding chain-of-thought may not stop reasoning distillation.
The implications extend beyond API security. Any deployment of a reasoning model — whether through an API, a consumer app, or an enterprise integration — potentially leaks enough signal for trace inversion. The attack requires only the ability to query the model and observe its outputs.
Researchers demonstrated that synthetic traces produced through inversion can match the distillation effectiveness of genuine extracted traces in certain task categories. The technique works best on structured reasoning tasks like mathematics and code generation, where intermediate steps follow predictable patterns.
Encryption alone cannot solve this problem. The fundamental issue is that reasoning models must produce outputs that reflect their internal logic.
How Should Developers Secure Agent Logs and API Integrations?
Developers must treat every agent log as a potential leak vector and implement strict hygiene practices immediately. The 62 live API keys found in public agent logs demonstrate that current practices are woefully inadequate.
First, never log raw API responses that include encrypted reasoning blocks. Strip signature fields and encrypted payloads before writing logs to disk or transmitting them to observability platforms. Use environment variables for API keys rather than embedding them in code that might end up in version control.
Second, implement automated scanning of repositories for exposed credentials. Tools like GitHub’s secret scanning can catch API keys before they go public, but only if they are configured and monitored. The 182 credentials found by researchers suggest many teams skip this step.
- Strip encrypted reasoning blocks from all logs before storage
- Rotate API keys on a regular schedule of 30 days or less
- Use secret management services rather than plaintext config files
- Scan every commit for exposed credentials automatically
- Avoid committing agent conversation logs to public repositories
- Implement output filtering that redacts reasoning-related fields
- Train engineering teams on the sensitivity of reasoning payloads
- Monitor API usage for anomalous query patterns indicating extraction
Third, assume that any reasoning trace you receive from an API will eventually be extractable. Design agent architectures that do not depend on the long-term secrecy of chain-of-thought content.
What Are AI Providers Doing to Fix the Chain-of-Thought Leak?
Major AI providers are actively investigating the vulnerability and exploring architectural changes to how reasoning blocks are transmitted. The WIRED report confirms that OpenAI, Anthropic, and Google have all been notified of the findings before publication.
The core challenge is structural. Providers return encrypted reasoning blocks to clients because the blocks are needed to maintain conversation continuity across multi-turn interactions. Removing them would break stateful reasoning, but keeping them creates the extraction vulnerability.
Possible fixes include server-side session management that eliminates the need to send reasoning blocks to clients at all. This approach would require significant API redesign and could introduce latency or state management overhead. Providers must weigh security against developer experience.
Another approach involves per-session encryption keys that are never exposed to the client. The reasoning blocks would be encrypted with a key tied to a specific session and decrypted only on the server side when needed for context continuity. This would prevent cross-session replay attacks documented in the paper.
Providers face a difficult balance. Tightening encryption may slow inference or complicate the developer experience, while leaving the current system in place invites continued trace extraction. The research community has made clear that the status quo is untenable.
Frequently Asked Questions
Can encrypted reasoning traces be decrypted by clients?
No, clients cannot directly decrypt the encrypted reasoning blocks returned by APIs. However, researchers decoded 315,320 blocks from public repositories by exploiting the way blocks are structured and reused across sessions, according to explainx.ai. The extraction technique does not break encryption but rather exploits patterns in how blocks are generated and transmitted.
Which specific models are affected by the reasoning trace vulnerability?
The vulnerability affects frontier reasoning models from all three major providers, including GPT-4.1 from OpenAI, Claude 3.7 from Anthropic, and Google’s Gemini models. Researchers verified their extraction technique against every frontier AI company’s API and confirmed a 1:1 match between extracted reasoning tokens and billed thinking tokens, as noted in Alexander Panfilov’s announcement on X.
How many API keys were found exposed in public agent logs?
Researchers found 62 live API keys and 182 total credentials in public agent logs across repositories like GitHub. The AI Governance Institute reported that these credentials were scattered across logs containing encrypted reasoning blocks, creating a dual exposure where attackers could both steal existing traces and generate new ones.
Does hiding chain-of-thought actually prevent model distillation?
Not entirely. A separate paper titled “How to Steal Reasoning Without Reasoning Traces” demonstrates that trace inversion techniques can reconstruct synthetic reasoning traces from model outputs alone, as covered by alphaXiv. This means that even perfect encryption of chain-of-thought would not fully prevent determined attackers from distilling reasoning capabilities into weaker models.
Summary
The reasoning trace vulnerability exposed by Panfilov, Andriushchenko, and colleagues represents a fundamental crack in how proprietary AI providers protect their most valuable intellectual property. Three key takeaways define this threat landscape:
Encryption is not enough. Providers encrypt reasoning blocks, but researchers decoded 315,320 of them from public logs. The blocks are reusable across sessions, users, and models, making every leaked log a potential training dataset.
Developer hygiene is critical. The 62 live API keys and 182 credentials found in public agent logs show that basic security practices are failing. Teams must strip reasoning payloads from logs, rotate keys aggressively, and scan repositories for exposed secrets.
Trace inversion bypasses encryption entirely. Even if providers fix the encrypted block problem, attackers can reconstruct synthetic reasoning traces from outputs alone. The distillation threat cannot be solved through encryption alone.
The frontier AI industry now faces a question with no easy answer: how do you serve a reasoning model via API without leaking the reasoning itself? The current architecture is broken. What replaces it remains unclear.
If your team builds agents on top of frontier APIs, audit your logging pipeline today. Every encrypted block in a public repo is an open invitation to trace thieves.