Encrypted Reasoning Traces Replay Across OpenAI, Anthropic, and Google APIs, Recovering Live Credentials From Public Logs

The encrypted reasoning objects that OpenAI, Anthropic, and Google return through their APIs, and the public agent trajectory logs that developers publish containing them

Researchers at the ELLIS Institute Tübingen and the Max Planck Institute for Intelligent Systems published "Stealing Reasoning Traces from Proprietary LLM APIs" (arXiv 2608.09867) on August 10, 2026, with broad coverage following on August 13. The encryption itself was never broken. The opaque reasoning blocks were portable: the same object could be replayed across sessions, across users, and across models from the same provider, and a weaker sibling model could be prompted to transcribe what a stronger one had been thinking. Claude Haiku 4.5 decoded Claude traces, GPT-5.6 Luna decoded OpenAI traces, and Gemini Robotics ER-1.6 decoded Google traces. Applied at scale to 6,708 public agent trajectories, the team decoded 315,320 thinking blocks and recovered 704 privacy artifacts from genuine user sessions, among them 62 API keys, 33 passwords, 24 access tokens, and seven private keys. Four attack classes follow: distilling a competitor's proprietary reasoning, extracting private data from published traces, recovering harmful content the model hid behind a safe visible answer, and smuggling prompt injections inside a block no human reviewer can read. Johns Hopkins cryptographer Matthew Green had reported the underlying replay behavior in May 2026; OpenAI called it unreproducible and Anthropic saw no security implications at the time. The researchers disclosed to OpenAI, Anthropic, Google, Microsoft, and Hugging Face, and report that the demonstrated attacks stopped working by August 2026. Traces already published remain decodable

A single global encryption key per provider, applied to an object designed to preserve reasoning across stateless API calls, with no binding to the session, the user, or the model that produced it. Encrypting a payload while leaving it freely replayable protects it from inspection in transit and not at all from replay, and agent frameworks that log full API transcripts turned that gap into a public credential store