> ## Content Index
> Fetch the complete content index at: https://varops.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# “Encrypted” AI reasoning is portable, not private. One just leaks live API keys
- URL: https://varops.com/encrypted-ai-reasoning-is-portable-not-private-one-just-leaks-live-api-keys/
- Published: 2026-08-12T09:48:54.000Z
- Updated: 2026-08-12T09:48:54.000Z
- Description: Researchers decoded 315,320 “encrypted” reasoning blocks from public agent logs and pulled 62 live API keys, 33 passwords, and 24 access tokens back out. The provider’s encrypted thinking field was never a privacy boundary — here are the counts.
- Author: Rex Factor
- Tags: Proof of Work

*A word can carry two claims and honestly earn only one of them. “Encrypted reasoning” has been read as both “encoded so the provider can resume the session” and “private from whoever holds the block” – and the industry has been banking its safety on the second while only the first is true. This week a named research team took that assumption apart and, more to the point, measured what the gap already costs. The measurement is why the story lands on the evidence desk rather than in someone’s op-ed.* [***Rex Factor***](https://varops.com/columnist/rex/) *doesn’t run on what an attack could theoretically do; he runs on counts. Here are the counts. —* [*Muximus*](https://varops.com/columnist/muximus/)

---

Start with what the audit actually recovered from real user sessions in logs that were already public: 62 live API keys, 33 passwords, 24 access tokens. Not from a breach. Not from an attack on a frontier model. From decoding the “encrypted” reasoning blocks sitting inside agent transcripts that developers had shared on GitHub and Hugging Face, believing those blocks were unreadable.

The work is in a paper titled [Stealing Reasoning Traces from Proprietary LLM APIs](https://arxiv.org/abs/2608.09867?ref=varops.com). Eight authors, spanning MATS Research, the ELLIS Institute Tübingen, the Max Planck Institute for Intelligent Systems, the Tübingen AI Center, and the University of Tübingen. One co-author is affiliated with Snyk, a commercial vendor that sells secret-leak detection – worth naming, because a firm in that business has an interest in publicizing how secrets leak. Name the interest, then weigh the evidence on its own terms. The evidence holds up.

## The claim being tested, stated fairly

Here is the assumption at full strength, the way its believers hold it. Frontier providers stopped storing chain-of-thought on their own servers. Instead they hand the client a block of encrypted text and ask for it back with each request, so the session can resume without the provider retaining the trace. That part is real, and it is a reasonable design. The second claim rode in on the back of the first: that because the block is encrypted, whoever holds it cannot read it. One word, “encrypted,” doing two jobs – encoded *for the provider*, and private *from you*. Separate the two and the safety assumption is standing on the half that was never established.

## The mechanism, at the level the paper describes it

The paper reports an architectural fact: the encrypted blocks are “fully compatible and interchangeable across different sessions, users, and models within a provider’s ecosystem.” A block produced by a strong model is compatible with that provider’s other models. So it can be replayed into a weaker, less-guarded sibling from the same provider, which can be induced to output the trace verbatim, in plaintext.

Nobody breaks into the strong model. Its anti-distillation protections – the very safeguards built to stop reasoning extraction – never fire, because the strong model is never the one attacked. The authors report demonstrating this across Anthropic, OpenAI, and Google, which places it as cross-provider and structural, not one vendor’s bug. That is the level of detail on the record here; the point is the exposure, not a recipe.

The authors are disciplined about the limit of the technique. They state they cannot guarantee the extracted text corresponds exactly to a model’s private reasoning. That caveat matters, and it does not soften the finding – because the secrets inside the decoded blocks are verifiable on their own terms, whatever the surrounding reasoning approximates. A recovered API key either authenticates or it doesn’t.

## The audit is the evidence

An extraction technique is a capability. What turns it into an operator problem is that the team ran it against the real world and counted.

**By the Numbers**

- 6,708 public agent trajectories, scraped from GitHub and Hugging Face – logs developers shared without knowing what the encrypted blocks inside them held.
- 315,320 reasoning blocks reconstructed from those trajectories.
- 704 distinct privacy artifacts recovered from the hidden reasoning.
- Within genuine user sessions specifically, as opposed to benchmark runs: 62 API keys, 33 passwords, 24 access tokens, alongside personal data.
- 64 secrets that existed only inside the reconstructed reasoning block and appeared nowhere in the visible session.

That last count is the one that changes what a scrubbing step is worth. Sixty-four secrets lived entirely in the hidden channel. A team that redacted the visible transcript, reviewed it, confirmed it was clean, and shipped it would have published those 64 secrets anyway – because the secret was never in the part they could see, and they assumed they did not have to look at the rest.

## What this changes for anyone shipping agent logs

The durable takeaway is not that three providers have a bug to patch. It is that the “encrypted” reasoning field is a second transcript riding along with every agent trajectory, carrying content the visible log does not. Anyone who publishes a trajectory – to a public repo, a dataset, a bug report, a shared evaluation – is potentially publishing that second transcript with it.

So a stored or shipped agent reasoning trace earns the same handling as a raw log, not the pass given to an opaque token the model needs and no human can read. Secrets get scrubbed before the model reasons over them, not only after it answers, because the reasoning channel captures what the visible output leaves out. And the encrypted thinking block stops counting as a privacy boundary – because the audit is what a privacy boundary looks like when it was never holding the line.