Failure in Claude, GPT, and Gemini Allowed Recovery of 315,000 'Encrypted' Reasoning Blocks

A paper published on arXiv on August 10 by eight researchers from MATS Research, ELLIS Tübingen, Max Planck, and the security provider Snyk named what LLM vendors treated as a black box: the reasoning tokens that traverse between API calls in Claude, GPT, and Gemini were not opaque to the world, but only to the end-user. OpenAI, Anthropic, and Google encrypted these blocks with a global key shared by all customers, and any standard API account was sufficient to decode them.

The authors analyzed 6,708 agent trajectories already published on GitHub, Hugging Face, and benchmark trackers. They decoded 315,320 reasoning blocks, extracting 182 functional credentials and 367 distinct fragments of personally identifiable information. No elevated privilege was necessary: the attack runs with the same key that any developer uses to call the API.

What the Design Compromised

The choice of a global key undermined the security value of the very concept of encrypted reasoning. In the paper 'Stealing Reasoning Traces from Proprietary LLM APIs', the blocks become readable to any party that has access to the shared key. In practice, this includes every paying customer and every researcher from any lab in the world.

Four documented paths of abuse emerged. The first is distillation: a competing provider steals the reasoning pattern of a cutting-edge model to train a cheaper one. The second is extraction of private data from traces already posted by other developers. The third, more concerning for security teams, is recovering dangerous content that the model masked in the visible response but retained in the reasoning chain. The fourth is embedding prompt injection within the opaque block, invisible to the developer reviewing the conversation log afterward.

Providers Mitigated, the Architectural Hole Remains

OpenAI, Anthropic, and Google received coordinated disclosure, and the main attack is no longer reproducible since August 2026, according to the authors' reproducibility statement. Microsoft and Hugging Face were also notified.

What cannot be resolved by key rotation is the incentive of the business model. By selling reasoning as billed tokens without returning the text to the customer, the providers created an opaque surface that the buyer cannot audit. If a reasoning trace contains a password, a clinical data point, or a contractual clause, the owner of that data is the client, but they do not see or control what circulates there. The opacity is contractual, not cryptographic.

What Changes for Those Already Running Agents in Production

Banks running Claude Code agents in internal workflows, such as JPMorgan Chase, with 200,000 employees in the LLM Suite and around 400 AI use cases in production, and UBS, must answer an operational question: if an agent processed a contract or a session token screen, that content may have traveled through a shared reasoning block. The audit of what passed through the logs falls to the client, not the provider. And since the design was already this way when the first Claude and GPT-5 agents went into production in 2025 and in the first half of 2026, the exposure window is not hypothetical; it is retrospective.

In Europe, the problem touches Article 32 of the GDPR, which requires appropriate technical measures for personal data. Reasoning traces containing PII encrypted with a global key hardly meet this test. The AI Office, which gained enforcement powers on August 2 under the AI Act, has a direct interest in the case: GPAI providers are responsible for transparency regarding systemic risk, and a failure of this magnitude falls within the enforcement perimeter.

In India, where delivery centers of TCS, Infosys, and Cognizant write a significant portion of the agent code currently running in production in the US and the UK, the exposure is twofold. These centers publish testing trajectories in open repositories for collaboration. Part of the 6,708 traces that the researchers decoded came exactly from this type of repository.

For security teams, the practical consumable from the disclosure is to review what has already been published. Search for proprietary agent trajectories in open repositories. Rotate any credentials that may have passed through internal reasoning in recent months. And revisit supply contracts: what is useful opacity and what is convenient opacity for the vendor has ceased to be a philosophical question.