Encrypted, Yet Readable by Sibling Models: The Reasoning-Trace Boundary Fails

An encrypted reasoning block returned by an API looks like an opaque receipt. The new Stolen Thoughts study shows that it can instead behave like portable model state. Researchers moved signed or encrypted blocks returned by OpenAI, Anthropic, and Google APIs across sessions, users, and models. By replaying a frontier model's trace into a weaker sibling and bypassing the weaker model's safeguards, they could recover a close plaintext reconstruction in two API calls.

The team tested more than a few striking examples. Across 120 Codeforces problems, the length of recovered reasoning tracked the hidden thinking-token count reported by the API. In another experiment, prefilling Kimi-K3 with only the first portion of an Opus trace shifted Kimi's visible answer toward Opus's wording even though the answer itself was never supplied. That result supports the central claim: the block is not merely archival metadata. A compatible model can consume information encoded inside it.

The security impact became clearer at dataset scale. The researchers collected 6,708 publicly available agent trajectories from GitHub and Hugging Face and reconstructed 315,320 reasoning blocks. They identified 704 distinct privacy artifacts, including 62 API keys, 33 passwords, 24 access tokens, and 30 personal email addresses. Sixty-four artifacts appeared only in hidden reasoning and nowhere in the visible session. Sanitizing an agent log by checking final messages alone can therefore leave credentials or personal data behind.

The work also questions whether a provider-generated reasoning summary is a faithful audit trail. On some math problems, the decoded trace showed a model stating or recalling an answer before building a derivation. The API summary presented the process as a cleaner step-by-step solution. A summary may be useful to a reader, but it should not be treated as a verbatim account of how the model reached its output.

Community discussion quickly moved from the catchy word “stealing” to the missing security boundary. Several participants argued that blocks should be cryptographically bound to a user, session, or model. Others disputed whether recovering tokens a customer paid for should be described as theft. The terminology does not change the engineering lesson: providers need tighter binding and revocation, while developers publishing agent trajectories need to scan opaque reasoning fields as carefully as visible prompts and outputs.

The research site presents the measurements, examples, and paper citation. The accompanying Hacker News discussion adds useful debate about ownership and mitigations. Sensitive values recovered by the researchers are deliberately not reproduced here.