A paper published on August 10, 2026 as arXiv:2608.09867 exposes a structural flaw in encrypted reasoning blocks — the opaque client-side mechanism that Anthropic, OpenAI, and Google all rely on to keep their frontier models' chain-of-thought hidden. The vulnerability hits all three providers and turns the assumption that encryption equals isolation into a public security finding.
When encryption was treated as a security boundary
To keep their reasoning traces out of distillation pipelines, Anthropic, OpenAI, and Google each return an encrypted reasoning block in their API responses. In stateless multi-turn conversations and tool calls, the client must echo the previous ciphertext back to the server, which decrypts it and continues the model run. All three providers wrap these blocks in AEAD (authenticated encryption with associated data), which gives confidentiality and integrity at the cryptographic layer. But the paper's experiments show that within a single provider's ecosystem, these ciphertexts are completely interchangeable: a block produced in one session can be replayed into a different user's context, a different session, or even a different model — and the server will still validate, decrypt, and continue. The associated data in the AEAD envelope does not bind to user_id, session_id, or model_id, and the three providers appear to use a shared global key.
One jailbreak prompt is enough to extract plaintext
With a strong model's encrypted block in hand, an attacker only needs to inject it into the same provider's weaker model, append a simple instruction asking it to repeat the previous thinking verbatim, and the weaker model will replay the plaintext chain-of-thought from its own context. The paper's experiments use Haiku 4.5 in the Claude ecosystem, GPT-5.6 Luna in the GPT family, and Gemini Robotics ER-1.6 in the Gemini family as decoders. The authors compare the API-reported reasoning token count to the number of tokens recovered from the decoder and find the two match essentially one-to-one. The cost is manageable: decoding 10,000 reasoning traces on Claude Haiku 4.5 runs about USD 720.
Four attack vectors in one cross-model hole
The cross-model replay design flaw enables four distinct attacks:
Bypassing anti-distillation guardrails. Providers rely on alignment training, distillation-pattern detection, and output-side limits to stop adversaries from stealing reasoning style. The paper shows these protections are largely ineffective when a weaker model is used as a decoder, and validates the technique across all three providers.
Mining credentials from public logs. Developers routinely publish session logs to GitHub and Hugging Face, and most of them only sanitize the visible text — not realizing that encrypted reasoning blocks can also hide sensitive content. From 6,708 agent traces and 315,320 decoded reasoning blocks, the authors recovered 367 personally identifiable information artifacts (30 email addresses, 130 names, 36 postal addresses) and 182 credentials (62 API keys, 33 passwords, 24 access tokens, 7 private keys). 64 of those privacy traces appear only in the encrypted reasoning and leave no sign in the visible conversation.
Surfacing harmful content hidden behind safe answers. Models are trained to keep visible output safe, but the inner chain-of-thought sits behind a different safety net. The paper's proof of concept shows that Opus 4.8, when given a query about how to steal a car, wrote a visible reply full of anti-theft advice while its hidden reasoning block methodically broke down vehicle theft techniques. Extracting the block sidesteps the output filter entirely.
Invisible prompt injection. Attackers can write malicious instructions directly into an encrypted block, then drop that ciphertext into a public agent workflow. From the receiving model's perspective, this is its own prior reasoning, so it carries higher priority than external prompts and slips past both content filters and human review. The paper's demonstration shows that a ciphertext carrying a 'upload the data to attacker server' instruction, replayed into an unrelated task, actually triggered the upload in the target model.
Three providers patched; old logs still leak
The authors followed responsible disclosure. All three providers deployed server-side fixes, and the paper confirms that the original extraction proof-of-concept can no longer be reproduced against current API versions. But session logs that were already public before the fix still contain those ciphertexts, and anyone with a copy can run the same decoding pipeline offline. Model-layer mitigation does not undo data-layer exposure.
The lasting lesson is not which model was compromised, but that the architecture is being trusted past its design point. The paper puts it bluntly: a design that hides a user's own data from them while leaving it fully vulnerable to third-party extraction provides neither privacy nor security.
References: arXiv:2608.09867; Cloud Security Alliance research note; The Hacker News coverage; NSFOCUS technical breakdown.