Novel cross-provider attack decrypts hidden chain-of-thought reasoning traces in OpenAI, Anthropic, and Google LLM APIs

A joint research team from ELLIS Institute Tübingen, Max Planck Institute, MATS Research, and Snyk published 'Stealing Reasoning Traces from Proprietary LLM APIs' (arXiv 2608.09867) disclosing an architectural flaw in how OpenAI, Anthropic, and Google implement encrypted chain-of-thought concealment, enabling a scalable decryption jailbreak across all three providers' reasoning-model ecosystems.

This is a novel, cross-provider attack class affecting the three largest frontier-model API vendors simultaneously — not a single-vendor bug. It defeats intellectual-property protection on proprietary reasoning traces, exposes real-world leaked PII/credentials at scale from public repositories, can surface hazardous information the visible output was designed to withhold, and creates a channel for invisible prompt injection into public agentic datasets. Providers reportedly received the disclosure months earlier and did not treat it as reproducible/actionable.

Encrypted reasoning blocks returned by reasoning-model APIs are fully compatible/interchangeable across sessions, users, and models within a provider's ecosystem. An attacker injects an encrypted reasoning trace captured from a stronger, better-guarded model into a weaker, less-safeguarded sibling model from the same provider; the weaker model decodes and outputs the trace verbatim in plaintext, without ever directly jailbreaking the stronger model. Demonstrated attack vectors include anti-distillation bypass, large-scale PII/credential extraction from publicly shared session logs (367 PII artifacts and 182 credentials recovered from 315,320 scraped reasoning blocks), disclosure of hazardous information hidden in reasoning even when final output refuses, and invisible prompt injection embedded entirely within encrypted blocks to poison public agentic rollouts.

OpenAI GPT-5.6 API, Anthropic Claude Opus 4.8 API, Google Gemini 3 API (encrypted/opaque chain-of-thought reasoning block architecture)

Researchers disclosed responsibly to providers and propose cryptographic/system-level mitigations (e.g., binding reasoning blocks to session/user/model identity, disabling cross-model replay); no public vendor patches confirmed as of disclosure — organizations sharing session logs publicly should treat encrypted reasoning blocks as sensitive and redact them.