Researchers Extracted Hidden Reasoning from OpenAI, Anthropic, and Google Models Using Shared Encryption Keys

A security research paper revealed that Anthropic, OpenAI, and Google all returned encrypted chain-of-thought blocks to API clients using shared encryption keys across model families. Researchers exploited this design flaw to extract hidden reasoning traces from frontier models by replaying encrypted blocks into weaker siblings and jailbreaking them.

How the Attack Worked

The vulnerability centered on how providers handled reasoning traces. When models generated step-by-step reasoning, APIs returned encrypted content blocks that looked like opaque strings: "encrypted_content": "gAAAAABqe6GjepE1wDjbFCZg0BHB6ucGnN0jvzqygG...". According to the paper, these blocks could be replayed across sessions, users, and even different models within the same family.

The critical flaw was that every model under the same family used identical encryption keys. Researchers took a trace produced by a frontier model, fed those encrypted blocks back into a weaker sibling model, jailbroke the weaker model, and recovered the stronger model’s hidden reasoning in plaintext.

You could observe these encrypted blocks by querying the API. For example, calling https://api.openai.com/v1/responses with a model like gpt-5.6-luna and including "reasoning": {"effort": "medium"} alongside "include": ["reasoning.encrypted_content"] would return output containing encrypted reasoning chunks with IDs like "rs_0a7479de7ebae170016a7ba1a0334c8198a95590217efe343c".

Limitations and Current Status

The attack required two conditions: access to both a frontier model and a weaker model in the same family, plus the ability to successfully jailbreak the weaker model. The technique exploited the fact that encryption keys were shared across model tiers rather than being unique to each model or user session.

All model providers acknowledged receipt of the security report. According to the researchers, the vulnerability has since been fixed - they were unable to launch the same attacks after providers patched their systems. This suggests the companies either changed their encryption key management strategy or modified how reasoning traces are handled across model families.

Implications for API Security

The research highlights an important principle: encrypted data returned to clients can become a liability if the encryption scheme allows replay attacks. Even though the reasoning content was encrypted, the ability to decrypt it using a different model in the same family created an unintended information disclosure path.

The vanity domain stolen-thoughts.com hosts the full paper detailing the methodology. For developers working with reasoning-enabled models, this research underscores that hidden reasoning traces aren’t necessarily private, even when encrypted. The attack vector existed because providers optimized for functionality - allowing reasoning blocks to work across sessions and models - without fully accounting for the security implications of shared encryption keys.

While the specific vulnerability has been patched, the research demonstrates how API design decisions around encrypted content can create unexpected attack surfaces. The fact that three major providers independently made similar architectural choices suggests this was a common pattern in reasoning-enabled model deployments.