Single Global Encryption Key Let Researchers Decode AI Reasoning from Published Logs

A new paper published on arXiv reveals that encrypted reasoning blocks from Anthropic, OpenAI, and Google APIs share a single global encryption key, making them decodable across sessions, users, and models. Researchers decoded 315,320 blocks from public agent logs and recovered API keys, passwords, and PII that developers thought were sealed.

How the Encryption Failed

The encryption scheme, Authenticated Encryption with Associated Data (AEAD), was designed to prevent tampering, not to prevent replay. Because the providers did not bind blocks to a specific session, user, or model, a block produced by Claude Opus 4.8 in one account could be replayed into a separate session using Claude Haiku 4.5. The weaker model accepts the block without complaint and can be prompted to read the reasoning aloud. This works because all three providers appear to use a single global encryption key rather than per-session or per-user keys.

What the Wild Scan Found

The research team scanned 6,708 publicly available agent trajectories from GitHub and Hugging Face and decoded all 315,320 thinking blocks they contained. From genuine user sessions, they recovered 62 API keys, 33 passwords, 24 access tokens, 7 private keys, 30 personal email addresses, and 6 non-localhost IP addresses. Crucially, 64 of the 704 artifacts recovered from real sessions appeared only in the hidden reasoning and nowhere in the visible conversation. One documented case: a GPT-5.2 Codex agent, asked to sanitize a repository, restated the API keys it was removing inside its hidden reasoning, which the developer then published believing it was sealed.

Four Attack Vectors

The paper identifies four distinct attack vectors enabled by the cross-model compatibility flaw. Reasoning distillation allows an adversary to recover a proprietary model's reasoning traces at scale and use them to train a competing model. Hazardous content extraction surfaces information the model was trained to withhold, as models often reason through harmful requests internally before declining. Invisible prompt injection embeds malicious instructions entirely within an encrypted reasoning block, which then executes in a separate session without appearing in visible text. Cross-user private data extraction means any developer who published raw API traces may have exposed the private contents to anyone with API access to a compatible model from the same provider.

Mitigations and the Legacy Log Problem

All three providers implemented mitigations following responsible disclosure, and the researchers confirm their specific attacks are no longer reproducible against current APIs. Anthropic updated its documentation to state that thinking blocks are tied to the model that produced them. OpenAI continues to instruct developers to replay encrypted reasoning items for stateless history management. Google indicates its backend now manages thought compatibility when a session transitions between models. However, no provider has publicly confirmed whether the 315,320 blocks already published to GitHub and Hugging Face can still be decoded post-mitigation. Mitigating new attacks and retroactively sealing already published data are distinct problems.

What Builders Should Do Now

The practical guidance is clear: strip reasoning blocks and opaque reasoning fields from any shared traces, and treat raw API transcripts as potentially containing sensitive material even if the visible text has been sanitized. Agent logs published before August 2026 that contain encrypted reasoning blocks from any of the three affected providers should be audited. Until providers confirm retroactive sealing, assume those blocks remain readable to any API caller.