Encrypted Reasoning Traces Can Be Extracted and Transcribed by a Sibling Model
Summary
New research (MATS/ELLIS/Max Planck) shows encrypted reasoning-trace blocks from Anthropic/OpenAI/Google APIs can be replayed into a cheaper sibling model that will transcribe the hidden reasoning in plaintext, because the encryption authenticates content but not the session/model context. Four attack vectors: distillation, jailbreak-reasoning extraction, scanning public agent logs (recovered 62 API keys, 33 passwords across 6,708 public trajectories), and prompt injection via published reasoning blocks. Also: recovered traces sometimes contradict the API's own displayed 'summary' of that reasoning.
Why this signal
A concrete, non-obvious way that safety/transparency mechanisms can silently fail — directly relevant to anyone building eval/oversight tooling around reasoning traces, and a caution against ever publishing agent session logs from AI-drift-review tooling without scrubbing encrypted blocks too.
Original email
ByteByteGo · 8/25/2026
How to Steal an AI Model's Private Thoughts