A new paper demonstrates that encrypted reasoning blocks from frontier models like Claude, GPT, and Gemini can be decoded and replayed to extract hidden chain-of-thought data. The authors show how these signed blobs can be transferred to weaker models or different sessions to transcribe the underlying thoughts, effectively bypassing the providers' obfuscation efforts.
- A scan of approximately 7,000 public traces revealed sensitive leaked data, including 62 unique API keys, 33 email addresses, and 33 passwords hidden exclusively within reasoning blocks.
- The technique involves obtaining a legitimate encrypted block, replaying it into a different request or weaker model from the same provider, and using specific prompts to force transcription of the attached reasoning.
- Specific methods were detailed for Claude (replaying to Haiku 4.5), GPT (injecting encrypted content with chunked continuations), and Gemini (attaching thought signatures).
- The vulnerability raises significant privacy concerns, as shared traces can leak personal data, and complicates alignment monitoring due to the terse or fragmented nature of the decoded thoughts.
The paper was responsibly disclosed, and several vulnerabilities have already been fixed, but the findings highlight persistent risks in how frontier labs handle and protect internal reasoning processes.