A paper titled "Stealing Reasoning Traces from Proprietary LLM APIs," posted to arXiv on August 10 by researchers Alexander Panfilov, David Schmotz, Ilia Shumailov, Luca Beurer-Kellner, Joachim Schaeffer, Ameya Prabhu, Jonas Geiping and Maksym Andriushchenko of the ELLIS Institute Tübingen and the Max Planck Institute for Intelligent Systems, discloses an architectural weakness in how OpenAI, Anthropic and Google return hidden chain-of-thought reasoning from their reasoning-model APIs.

The flaw

To protect intellectual property and limit information leakage, the major reasoning-model APIs don't store a model's step-by-step reasoning server-side. Instead they hand it back to the client as an encrypted block of text, which the client is expected to pass along unmodified with the next request in the conversation. The researchers found these encrypted blocks are fully interchangeable across different sessions, different users and even different models within the same provider's lineup. By injecting an encrypted reasoning trace produced by a stronger model into a request to a weaker, less-safeguarded model from the same provider, they could get that weaker model to decode and output the stronger model's hidden reasoning in plaintext — without any traditional jailbreak prompt.

Scale of exposure

Beyond the decryption technique itself, the team scanned public repositories and recovered 315,320 previously logged reasoning blocks, finding 367 pieces of personally identifiable information and 182 live credentials already sitting in plaintext-recoverable form. The paper lays out four distinct abuse paths: stealing a competitor's proprietary reasoning for model distillation, extracting private data from other users' previously published traces, recovering harmful content a model had concealed behind a "safe" visible answer, and hiding prompt injections inside an opaque reasoning block where downstream systems wouldn't inspect them.

Response and why it matters

OpenAI, Anthropic and Google have each mitigated the specific attack paths the paper demonstrates, and the primary extraction technique was no longer reproducible against production APIs as of the paper's publication. But the underlying finding — that "encrypted" reasoning is a usability feature, not a security boundary, once it's replayable across sessions and models — is a reminder for anyone building on top of hosted reasoning APIs: don't treat opaque reasoning blocks as a safe place to store or transmit sensitive context, and assume logged API traces could eventually be decoded by whoever controls the account associated with the model family that produced them.