Claim◆Article · 0:00 — 2:00

Critical Thinking: Encrypted reasoning blocks from frontier API responses can be decoded and ported to different models, sessions, and users, which dramatically improves open models and leaks personal data when shared publicly.

The paper breaks the assumption that lab reasoning traces are secure. It shows encrypted reasoning blocks can be decoded and replayed, ported to weaker models to transcribe, improving open models — and leaking personal data from publicly shared traces. ✦ AI generated

AINews host (unattributed editorial) · Latent Space · 2026-08-12 · original ↗

Share card ↓Export .md Export .txt

Since the o1 launch, frontier lab reasoning models have obscured their traces, with cryptographic signatures, for fear of distillation... Today's paper demonstrates that it is possible to DECODE and port these encrypted thoughts to different models/sessions/users… and to dramatically improve open models as a result. The alarming note is here: 'Further, if you ever shared online a Claude Code/Codex session with encrypted reasoning blobs, they can be decoded and leak your personal data. We did a preliminary scan of ~7,000 public traces and found 62 unique API keys, 33 email addresses, 33 passwords, and other sensitive data.'

Read full article ↗excerpt · fair-use quotation

✳ Claude Code ✳ Codex ◉ Matthew Green

Around this claim

Mechanism · 3

Every model under the same family shares the same encryption key, so blocks captured from one model can be fed back into the weakest family members, which can be jailbroken into outputting the unencrypted raw reasoning blocks.Paper authors (via Hacker News, stolen-thoughts.com) · Simon Willison's Weblog · conf 80%Anthropic, OpenAI, and Google return encrypted chain-of-thought blocks to clients that can be replayed across sessions, users, and models, and a weaker sibling model can be jailbroken to recover the stronger model's hidden reasoning in plaintext.Paper authors (via Hacker News, stolen-thoughts.com) · Simon Willison's Weblog · conf 80%Critical Thinking: The attack reuses a valid encrypted reasoning block by replaying it into a different request, placing it in an assistant/model turn, and prompting a weaker model to transcribe the attached reasoning.AINews host (unattributed editorial) · Latent Space · conf 70%

Extends · 1

Critical Thinking: The practical corollaries of this episode are that public trace sharing is risky, hidden CoT is not a reliable monitoring interface, and labs may need stronger guarantees around sandboxing, telemetry, and tool surfaces.AINews Twitter recap (attributed to @BlackHC) · Latent Space · conf 70%

This moment responds to

rebuts → Critical Thinking: The trace-exposure vulnerability does not imply practical mass theft of chain-of-thought for model training; it is more a stateless distributed-inference protocol optimization than a confidentiality barrier.AINews Twitter recap (attributed to @vipulved) · Latent Space extends → Critical Thinking: The attack generalizes across model providers with concrete per-model templates, including bypassing an apparent ~50-token verbatim-output threshold via chunked continuations.AINews host (unattributed editorial) · Latent Space