Very big warning from this paper.

Your AI's hidden reasoning can become a second, invisible data leak.

You can clean the visible chat and still accidentally publish passwords, API keys, or private data.

A company can secure its smartest model perfectly and still lose its secrets through a cheaper model in the same family. The weakest model can become the security hole for the strongest one.

Encrypted reasoning is supposed to hide what frontier models think, but this paper shows the encrypted blob itself can become the attack surface.

Anthropic, OpenAI, and Google APIs return opaque reasoning blocks to clients so they can be replayed in later turns without storing the reasoning server-side.

The problem is portability: the authors found these blocks could be reused across sessions, users, and even models within the same provider.

That lets an attacker take a trace from a stronger model, feed it to a weaker compatible sibling with looser safeguards, and use that model as a decoder.

Across public agent logs, the team decoded 315,320 reasoning blocks from 6,708 trajectories; 328 sessions, or 4.9%, leaked at least one sensitive item.

In genuine user sessions, they recovered 62 API keys, 33 passwords, 24 access tokens, and 30 personal emails.

So an encrypted reasoning field in a log is not necessarily safe metadata if another model can read it.

After responsible disclosure, providers patched the reported attacks, and the exact exploits were no longer reproducible by August 2026.