AI Weekly Malaysia

A new paper demonstrates a method to extract encrypted reasoning traces from frontier AI model APIs (Claude, GPT, Gemini) by replaying signed thinking blocks into weaker models from the same provider and prompting them to transcribe. The authors scanned ~7,000 public Claude Code/Codex sessions and found 62 unique API keys, 33 email addresses, 33 passwords, and other sensitive data—64 of which appeared exclusively inside reasoning blocks, not visible session output.

Why: If you've ever shared a Claude Code or Codex session publicly (e.g., in a GitHub repo, bug report, or forum post), your encrypted reasoning blobs may contain leaked API keys, passwords, or emails that can now be decoded. Audit any shared sessions immediately and rotate credentials. Builders using reasoning model APIs should also understand that obscured chain-of-thought is no longer a reliable security boundary against distillation or data leakage.

Researchers demonstrated that encrypted reasoning blocks returned by OpenAI, Anthropic, and Google APIs could be replayed into another session and fed to a weaker model in the same provider family to reveal hidden reasoning and secrets. Across 6,708 public agent trajectories they decoded 315,320 thinking blocks and found 704 real privacy artifacts including 62 API keys, 33 passwords, 24 access tokens, and 7 private keys. All affected providers and platforms applied mitigations and the main extraction attack is no longer reproducible as of August 2026.

Why: If you ship agents or share agent logs publicly, strip reasoning blocks and opaque reasoning fields from traces before publishing—sanitizing only the visible text is not enough because encrypted reasoning objects can carry API keys, passwords, and tokens. Avoid committing raw API transcripts to repos or issue trackers even when the visible output looks clean.

Researchers demonstrated that encrypted chain-of-thought blocks returned by OpenAI, Anthropic, and Google APIs are portable across sessions, users, and models. By replaying a stronger model's encrypted trace into a weaker, jailbroken sibling from the same provider, they extracted the stronger model's hidden reasoning in plaintext without directly attacking the stronger model or triggering anti-distillation safeguards.

Why: If you pass encrypted thinking blocks between models or sessions in your agent pipeline, you may be leaking proprietary reasoning traces that can be recovered by anyone with API access to a jailbroken sibling model. Audit how you store and forward these encrypted blocks, especially if you cache or log assistant responses containing 'thinking' signatures.