News · 2026-08-12

A prompt injection can hide inside an encrypted reasoning block nobody can read

The paper behind the reasoning-trace decoding attack is now public on arXiv with its full accounting, and the fourth of its four attack vectors is the one that has not been widely discussed: an attacker can embed a prompt injection entirely inside an encrypted thinking block, where no human reviewer and no text filter can see it, then pass it into a public agent run. Alexander Panfilov and seven co-authors decoded 315,320 reasoning blocks scraped from public repositories, recovering 367 pieces of personally identifiable information and 182 credentials along the way.

Key facts

• The paper demonstrates the extraction across Anthropic, OpenAI, and Google models.
• 315,320 encrypted reasoning blocks decoded from public repositories yielded 367 PII artifacts and 182 credentials.
• Four attack vectors: anti-distillation bypass, private data extraction, disclosure of hazardous content the visible answer refused, and invisible prompt injection.
• Authors include Alexander Panfilov, Ilia Shumailov, Jonas Geiping, and Maksym Andriushchenko, with responsible disclosure completed before publication.

The architecture flaw in one sentence

Frontier providers hide their models' step-by-step reasoning to protect it. Rather than storing those traces on their servers, they encrypt them and hand them back to the client, which passes them along with each subsequent request. The paper's finding is that those encrypted blocks are "fully compatible and interchangeable across different sessions, users, and models within a provider's ecosystem."

That interchangeability is the whole vulnerability. Inject a trace from a strong model into a weaker, less-safeguarded model from the same provider, and the weaker one will decode it and print the contents verbatim. The strong model is never jailbroken. It does not have to be. As we described when this first surfaced, the sibling model is used as a decryption oracle.

The injection vector is the underrated one

Three of the four attacks are extraction: pulling reasoning out, pulling private data out, pulling hazardous content out of a trace whose final answer safely refused. Those are serious. The fourth runs in the opposite direction and is worse in kind.

Because an encrypted block is opaque to everyone downstream, an attacker can put malicious instructions inside one and ship it. The paper describes embedding payloads "entirely within encrypted blocks to poison public agentic rollouts." Consider what that means in practice. Agent trajectory datasets are shared publicly and used for training and evaluation. Multi-agent systems pass reasoning between components. Anyone auditing that data sees an opaque blob, because that is exactly what the encryption was designed to produce. A prompt injection hidden in plain text can at least be found by reading. This one cannot be found by anyone except the model that unpacks it.

The security property that was supposed to protect the provider's intellectual property turns out to also protect an attacker's payload. That is the kind of inversion that shows up repeatedly when opacity is used as a security control.

What the private data finding says about everyone's habits

The 315,320 decoded blocks came from public repositories, put there by developers sharing session logs. Those developers knew what was in the visible text. They did not know what was in the encrypted portions, because nobody can read them without this attack. Buried in there were 367 PII artifacts and 182 credentials.

This is a straightforward consequence of a reasoning model's design: the model thinks about the material it was given, including the material you would rather it did not repeat. The visible answer is filtered. The hidden trace is not filtered in the same way, and the paper shows it sometimes contains hazardous detail the final answer explicitly refused to provide. Anyone who has committed a session log to a repo should assume the encrypted parts contain whatever the model was thinking about, which is to say, everything.

What is fixed and what is not

The authors disclosed to the providers before publishing and propose concrete cryptographic and system-level mitigations. The cross-user path is closeable with a simple change: bind a block cryptographically to the session and user that produced it, so a trace from one conversation cannot be replayed into another. Both Anthropic and Google already require thinking-block signatures to be returned unchanged, per their extended thinking and thought signature documentation, and tightening what those signatures bind to is an incremental change rather than a redesign.

The distillation path is harder. The reason encrypted traces get returned to the client at all is that the model needs the prior reasoning to continue the conversation, so it must be processed somewhere. Closing off replay entirely means either storing traces server-side, which reintroduces the cost providers were avoiding, or accepting that a determined party can extract reasoning and use it to train a competitor. The paper's separate result on this is suggestive rather than conclusive: prefilling a rival model with the first one percent of a decoded trace shifted its visible answers toward the source model on 29 of 30 problems. That is consistent with distillation being feasible, not proof that anyone has done it.

The caveat

The 29-of-30 result is the load-bearing claim for the distillation argument and it is the weakest link in the paper, measuring style convergence rather than capability transfer. The providers' current mitigation status is also not fully public: the authors say disclosure was completed and acknowledged, but the labs have not published detailed accounts of what changed. If you build on these APIs, the actionable item is not to wait for that. It is to stop treating encrypted reasoning blocks as safe to publish, and to stop treating them as safe to ingest. See also our notes on model extraction attacks and chain-of-thought faithfulness.

Primary source, verified: read the paper → (arXiv 2608.09867)

Ground Truth. (2026, August 12). A prompt injection can hide inside an encrypted reasoning block nobody can read. Ground Truth. https://groundtruth.day/news/a-prompt-injection-can-hide-inside-an-encrypted-reasoning-block-nobody-can-read.html

@misc{groundtruth:a-prompt-injection-can-hide-inside-an-encrypted-reasoning-block-nobody-can-read,
  title  = {A prompt injection can hide inside an encrypted reasoning block nobody can read},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {aug},
  url    = {https://groundtruth.day/news/a-prompt-injection-can-hide-inside-an-encrypted-reasoning-block-nobody-can-read.html}
}

Topics: cybersecurity · ai-security · prompt-injection · model-extraction · privacy · red-teaming