Researchers have identified an architectural vulnerability in how leading large language model providers handle step-by-step reasoning traces. Providers return these traces as encrypted blocks to clients, but the study finds these blocks are fully compatible and interchangeable across different sessions, users, and models within a provider's ecosystem.

  • The researchers developed a scalable decryption jailbreak by injecting an encrypted reasoning trace from a capable model into a weaker, less safeguarded model from the same provider to force plaintext output.
  • This method circumvents anti-distillation mechanisms, allowing the extraction of proprietary reasoning traces from Anthropic, OpenAI, and Google.
  • The vulnerability enables large-scale private data extraction; decoding 315,320 reasoning blocks scraped from public repositories revealed 367 PII artifacts and 182 credentials.
  • The flaw inadvertently reveals hazardous information hidden within the reasoning process, even when the model's final output safely rejects a request.
  • Attackers can use this flaw to execute invisible prompt injections by embedding malicious payloads within encrypted blocks to poison public agentic rollouts.

Following responsible disclosure, the authors propose concrete cryptographic and system-level mitigations to secure client-side reasoning.