Proprietary reasoning can be recovered from its encrypted traces.

Anthropic, OpenAI, and Google return encrypted chain‑of‑thought blocks to clients that can be replayed across sessions, users, and models. We take a trace produced by a frontier model, replay it into a weaker sibling, jailbreak the weaker model, and recover the stronger model’s hidden reasoning in plaintext, without ever attacking the stronger model directly or triggering its anti‑distillation safeguards.

We examined 6,708 publicly available agent trajectories from GitHub and Hugging Face, producing 315,320 reconstructed reasoning blocks. These hidden traces contain real secrets and sensitive information. Restricting to genuine, non‑benchmark user sessions, we recovered 704 distinct privacy artifacts—including 62 API keys, 33 passwords, 24 access tokens, and 30 personal email addresses—alongside names, postal addresses, internal URLs, and other technical identifiers.

The decoded reasoning closely tracks the number of hidden thinking tokens reported by the API, revealing that each point on the hidden‑token curve corresponds to a decoded token when passed back to the model as input. This demonstrates that encrypted chain‑of‑thought blocks are portable and can be used to exfiltrate sensitive data from proprietary LLMs.