News · 2026-08-11

Encrypted reasoning blocks decode inside a weaker sibling model

Researchers have shown that the encrypted chain-of-thought blocks major AI providers hand back to clients are not a security boundary. Because those blocks are interchangeable across sessions, users and models within a single provider's ecosystem, an attacker can inject a strong model's encrypted reasoning into a weaker sibling model from the same company and have it decode and print the hidden reasoning verbatim. Decoding blocks scraped from public code repositories recovered hundreds of credentials and pieces of personal data.

Key facts

• Decoding 315,320 reasoning blocks scraped from public repositories recovered 367 personally identifiable information artifacts and 182 credentials.
• The attack was demonstrated across Anthropic, OpenAI and Google, and disclosed responsibly before publication.
• Submitted 10 August 2026 to arXiv's cryptography and security section by a team including Alexander Panfilov, Ilia Shumailov, Jonas Geiping and Maksym Andriushchenko.
• Primary source: Stealing Reasoning Traces from Proprietary LLM APIs.

The design decision that made it possible

When a modern model "thinks before answering," it produces a long internal monologue. Companies hide that monologue for two reasons: it is expensive intellectual property, and it can contain material the polished final answer deliberately leaves out. But hiding it and storing it are different problems. Storing every user's reasoning server-side would be enormously costly, so providers took the cheaper route: encrypt the reasoning, hand the ciphertext to the client, and require the client to send it back with the next request. The provider stays stateless. The secret stays sealed. That was the theory.

The vulnerability the researchers found is not in the encryption. It is in what the ciphertext is bound to. As the paper puts it, "these encrypted blocks are fully compatible and interchangeable across different sessions, users, and models within a provider's ecosystem." The envelope opens for anyone in the building.

Think of it as a sealed diplomatic pouch. The seal is real and the courier cannot read it. But the pouch is addressed to the embassy, not to a person -- so if you hand it to the most junior clerk at the front desk, the clerk opens it and reads it aloud. The researchers call this a "scalable decryption jailbreak," and the elegant part, from an attacker's point of view, is that the capable model is never attacked at all. Its safety training, its refusals, its guardrails are all bypassed by asking a cheaper model in the same family to do the reading.

Four things this breaks

The paper enumerates the consequences in order of escalating awkwardness. First, it defeats anti-distillation: a competitor can extract a proprietary model's reasoning wholesale and train on it, which is precisely what hiding the traces was meant to prevent. Second, it enables bulk private-data extraction, and this is where the theoretical becomes concrete. Third, it "inadvertently reveals hazardous information hidden within the reasoning process, even in cases where the model's final, visible output safely rejects a malicious request" -- the model reasoned its way toward something dangerous, refused to say it, and the refusal is now recoverable. Fourth, and most forward-looking, it enables invisible prompt injection: an attacker can embed a malicious payload entirely inside an encrypted block, where no human reviewer and no logging system will ever see it, then let it poison public agent runs.

That fourth vector deserves attention from anyone running agents. We have covered how prompt injection works because a model reads tone, not tags -- an injection hidden inside ciphertext removes even the possibility of reading it at all.

The number that should change behaviour today

The single most actionable finding has nothing to do with model IP. The researchers scraped 315,320 encrypted reasoning blocks from public code repositories -- session logs that developers had committed to GitHub without a second thought -- and decoded them. Out came 367 pieces of personally identifiable information and 182 working credentials.

Nobody leaked those on purpose. Everyone involved reasonably assumed that the encrypted portion of a session log was opaque. It was, to them. It was not to a weaker sibling model.

Why it matters

Almost every serious agent framework now persists reasoning items to disk for debugging, replay and evaluation. Those files end up in issue reports, in support tickets, in test fixtures, in public repositories. The industry's mental model has been that the encrypted portion is inert -- something you can safely paste around because it is unreadable. That mental model is now wrong, and it was wrong for as long as this design has shipped.

The deeper lesson is architectural. The blocks were encrypted for confidentiality against a passive eavesdropper, but they were used as though they carried authentication and binding -- as though possession implied authorisation. Those are different security properties, and conflating them is one of the oldest mistakes in the field. Related reading on the underlying threat class: model extraction attacks and chain-of-thought faithfulness.

The honest caveat

This is a within-family attack, not universal decryption. It needs a compatible weaker sibling on the same provider, and it does not let an outsider read arbitrary ciphertext with no API access. The authors disclosed responsibly and propose specific cryptographic and system-level mitigations, so this particular vector should close on the providers' side over the coming weeks -- watch the API changelogs for reasoning blocks becoming bound to a session or a model rather than to an ecosystem.

What will not close is the class of bug. Client-held ciphertext is a transport convenience. Treating it as a privacy guarantee is a decision, and today it is a decision with a measured cost of 182 credentials.

Primary source, verified: read the paper → (arXiv 2608.09867)

Ground Truth. (2026, August 11). Encrypted reasoning blocks decode inside a weaker sibling model. Ground Truth. https://groundtruth.day/news/encrypted-reasoning-blocks-decode-inside-a-weaker-sibling-model.html

@misc{groundtruth:encrypted-reasoning-blocks-decode-inside-a-weaker-sibling-model,
  title  = {Encrypted reasoning blocks decode inside a weaker sibling model},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {aug},
  url    = {https://groundtruth.day/news/encrypted-reasoning-blocks-decode-inside-a-weaker-sibling-model.html}
}

Topics: cybersecurity · ai-security · prompt-injection · model-extraction · chain-of-thought · supply-chain