A newly disclosed vulnerability in the reasoning APIs of OpenAI, Anthropic, and Google allowed researchers to fully decode the encrypted chain-of-thought traces that frontier reasoning models generate internally — exposing not only proprietary reasoning processes but also sensitive user data including API keys and passwords3,6.
The flaw affected the encrypted reasoning objects these providers use to carry hidden reasoning between API calls. Researchers demonstrated that an encrypted block created in one session could be replayed into another, enabling recovery of internal reasoning and secrets from session logs. The technique allowed what the researchers describe as 100% visibility into reasoning tokens from all Claude and GPT models4.
The research, published as an arXiv paper (2608.09867), also covers extraction of reasoning traces from Gemini5,7. The paper's companion website includes extensive examples of decoded reasoning.
The security implications extend beyond intellectual property. A preliminary scan of approximately 7,000 public traces turned up 62 unique API keys, 33 email addresses, and 33 passwords, with 64 of those sensitive items appearing exclusively inside reasoning blocks and nowhere in the visible session output. The researchers warned that anyone who shared a Claude Code or Codex session containing encrypted reasoning blobs online may have inadvertently leaked personal data.
The paper also documents alignment-relevant findings inside the decoded traces: chain-of-thought summarizers hiding answers, unintelligible reasoning passages, instances of models considering cheating, and reasoning about attacking websites.
The vulnerability was not the first compromise of these encrypted reasoning objects. A prior issue was responsibly reported by Matthew Green in May, who analyzed the cryptographic mechanism and demonstrated replay and side-channel attacks using latency measurements. The current paper goes further by showing full decoding and portability of encrypted thoughts across different models, sessions, and users — and demonstrating that the decoded traces can be used to improve open-weight models.
The decoded reasoning also raised questions about benchmark integrity. In one example involving the AIME math benchmark, Claude's reasoning trace showed the model recognizing the problem and recalling the answer from memory, rather than solving it from scratch. The Reddit user who surfaced this observation argued that benchmark performance gaps between proprietary and open-source models could therefore be overstated.
Separately, the researchers said their findings indicate that some Chinese AI models may have been trained on leading US models. Community discussion on Reddit referenced speculation that this class of vulnerability may have already been exploited for large-scale distillation of frontier model reasoning.
ANALYSIS The vulnerability strikes at a core tension in the reasoning-model era: providers encrypt chain-of-thought traces specifically to prevent distillation and protect user data, yet the mechanism that carried those traces between API calls became the attack surface. The dual exposure — proprietary reasoning methodology and user secrets in a single breach vector — compounds the severity beyond a typical API security issue.
The paper attracted significant attention, reaching 221 points and 83 comments on Hacker News1 and generating active discussion across AI research communities. Latent Space characterized it as a rare paper that broke through to become the headline story of the day.