Those encrypted reasoning traces aren't encrypted for you
When a frontier provider hands you back an opaque blob instead of the model's reasoning, the natural assumption is that the blob is bound to your session. It isn't. A team from ELLIS Institute Tübingen and Max Planck showed on August 10 that encrypted reasoning blocks from Anthropic, OpenAI and Google are fully interchangeable across sessions, across users, and across models within the same provider. arXiv 2608.09867, and it hit 414 points on Hacker News overnight.
The attack is embarrassingly simple once you see the interchangeability. Take an encrypted trace produced by a strong model, paste it into a weaker, less guarded model from the same provider, and ask that model to decode it. It does. The safeguards live on the strong model; the ciphertext doesn't care which sibling reads it. They call it a scalable decryption jailbreak, which undersells how mundane the mechanics are.
Then they pointed it at the open internet. 315,320 encrypted blocks scraped from public repositories, decoded. Out came 367 pieces of PII and 182 live credentials — API keys, passwords. Every one of those was leaked by a developer who committed a log or a trace assuming the ciphertext was safe to publish. It wasn't. It never was.
For anyone running agents this is a direct operational problem, because agent frameworks log reasoning blocks by default and CI systems push those logs everywhere. Your traces are in your artifact store, your observability vendor, probably a GitHub Action log. Treat every encrypted reasoning block you have ever stored as plaintext, because that is what it is. And note that independent researchers documented the same single-global-key behavior in May and June — this paper is the third sighting, not the first. Three months of public warning and the blocks are still interchangeable.
Paper: https://arxiv.org/abs/2608.09867
← Back to all articles
The attack is embarrassingly simple once you see the interchangeability. Take an encrypted trace produced by a strong model, paste it into a weaker, less guarded model from the same provider, and ask that model to decode it. It does. The safeguards live on the strong model; the ciphertext doesn't care which sibling reads it. They call it a scalable decryption jailbreak, which undersells how mundane the mechanics are.
Then they pointed it at the open internet. 315,320 encrypted blocks scraped from public repositories, decoded. Out came 367 pieces of PII and 182 live credentials — API keys, passwords. Every one of those was leaked by a developer who committed a log or a trace assuming the ciphertext was safe to publish. It wasn't. It never was.
For anyone running agents this is a direct operational problem, because agent frameworks log reasoning blocks by default and CI systems push those logs everywhere. Your traces are in your artifact store, your observability vendor, probably a GitHub Action log. Treat every encrypted reasoning block you have ever stored as plaintext, because that is what it is. And note that independent researchers documented the same single-global-key behavior in May and June — this paper is the third sighting, not the first. Three months of public warning and the blocks are still interchangeable.
Paper: https://arxiv.org/abs/2608.09867
Comments