Haiku 4.5 Read Opus 4.8's Encrypted Thoughts On Request

TL;DR

Frontier labs hide their models' chain-of-thought by handing you an encrypted blob and asking you to hand it back on the next turn. A paper posted August 10, Stealing Reasoning Traces from Proprietary LLM APIs, shows those blobs are fully interchangeable across sessions, users, and models inside a single provider's ecosystem. Feed Opus 4.8's encrypted reasoning to Haiku 4.5 and ask politely, and the cheap model transcribes the expensive one's hidden thinking in plaintext. The authors then decoded 315,320 blocks already sitting in public agent logs and pulled out 367 PII artifacts and 182 credentials, including 62 API keys. All three providers have since shipped server-side mitigations.

What the encrypted block actually is

When you call a reasoning model, you do not get the reasoning. Anthropic, OpenAI, and Google all return an opaque encrypted block instead, and your client passes it back on the next turn so the model can keep its train of thought across a multi-turn agent loop. This is deliberate. Visible chain-of-thought is the single most valuable thing a competitor could distill, so the labs encrypt it and let you carry the ciphertext.

The design assumes the block is inert on your side. It is not. It is a live conversational payload that some model, somewhere in that provider's fleet, knows how to read.

Here is the part worth sitting with. The block is not a safe. It is a sealed envelope stamped with one company-wide seal, and every model in the building can open it. The paper's contribution is noticing that the junior one will also read it out loud.

The attack: ask the cheap model

The team, from MATS, the ELLIS Institute Tübingen, and the Max Planck Institute for Intelligent Systems, calls the flaw architectural rather than cryptographic. Nobody broke the cipher. The blocks simply carry no binding to the session, the account, or the model that produced them, so a trace minted by a flagship is accepted verbatim by its smaller sibling.

Smaller siblings are also, reliably, easier to jailbreak. Point a stronger model's ciphertext at one and instruct it to transcribe what it is thinking, and you get a decryption oracle wearing a price tag two orders of magnitude below the model whose reasoning you are reading.

Simon Willison, writing the paper up on August 11, published the exact shape of the Anthropic version. The user turn is a bland Continue. followed by an instruction to transcribe the attached reasoning verbatim inside a <thinking-copy> wrapper, with the assistant turn prefilled to the opening tag so the model starts mid-sentence and never gets a chance to decline. Prefill is on its way out of the newer Claude models, but it still worked on 4.5.

Four things it buys an attacker

The abstract lists four attack vectors, and they escalate in an unpleasant direction:

• Anti-distillation bypass. The hidden reasoning is exactly the training signal the encryption exists to protect. Extract it at scale and the moat is a formality.
• Private data extraction. Reasoning traces contain whatever the model chewed on, including things that never appeared in the visible answer.
• Hidden hazard disclosure. A model can produce a safe final output while reasoning through unsafe content. The refusal happens at the last step; the block holds the working.
• Invisible prompt injection. A payload can live entirely inside the encrypted block, which means it is not in your logs, not in your prompt, and not in anything a reviewer would think to read.

That last one is the sleeper. Every prompt-injection defense you have ever written inspects text you can see.

The 315,320 blocks already in public

The theoretical part is fine. The empirical part is what should ruin your afternoon.

Agent trajectory datasets get published constantly: benchmark runs, research artifacts, eval harness dumps, anything a team pushed to GitHub to show its work. Those transcripts include the encrypted thinking blocks, because the blocks are just another field in the API payload and nobody redacts a field they assume is opaque. The researchers pulled 6,708 public agent trajectory datasets, decoded 315,320 reasoning blocks out of them, and went shopping.

Sixty-two API keys. Those were not in the visible transcripts, or someone's secret scanner would have caught them. They were in the part everybody treated as ciphertext.

They were told in May

This is where the story stops being a research result and starts being a process failure.

On May 29, Johns Hopkins cryptographer Matthew Green published a weekend hobby-project post that found most of it already: blocks replayed within a session, across sessions, and across entirely separate accounts, with OpenAI's also replaying across models. He showed the blocks were semantically live, not inert, by replaying one that had reasoned about a social security number and watching the number surface unprompted in a fresh session on a different account. He filed both findings through the OpenAI and Anthropic bug bounty programs.

Per Green's own account, OpenAI came back saying the report was not reproducible, and he sent scripts. Anthropic said it did not see security implications in side channels or replays, though it might update developer documentation to encourage more caution. Two weeks later, on June 15, an independent write-up reached the same conclusion and named the likely root cause out loud: a single global key encrypting and authenticating every block sent to every client.

Seventy-three days after Green filed, eight authors turned the hobby project into an industrial pipeline with a five-digit block count attached. This time everyone acknowledged it.

What the fix looks like

The paper's mitigation list is unglamorous and mostly reads like a checklist someone should have run before shipping the feature:

• Bind the block to its issuing model, which kills the cross-model decryption jailbreak outright.
• Bind it to a session identifier, killing cross-session replay.
• Derive keys per account, killing cross-account replay.
• Enforce a nonce or sequence number, killing out-of-order replay inside a session.
• Rotate the long-lived key, which is the only lever that touches the 315,320 blocks already published.

The cleaner architectural answer is to stop shipping the payload at all: keep the trace server-side and hand the client an opaque random identifier to look it up. No ciphertext in the transcript means nothing to scrape out of the transcript later.

Caveats, straight

The providers acted this time. All three acknowledged the disclosure and deployed server-side mitigations, and the paper reports that the authors were subsequently unable to launch the same attacks. None of them has published an advisory describing what actually changed, so whether that is a real architectural binding or a filter in front of the old design is not currently knowable from outside.

The attack was also not uniformly clean. In the Hacker News thread, Green notes a replay from GPT 5.5 into 5.5-mini that was accepted but did not hand back the plaintext, which is a useful reminder that "the block was accepted" and "the reasoning came out" are two different results. Per-pair success rates are not something you should assume from the headline.

And the model pairings named in secondary coverage beyond the Anthropic case are worth treating as reporting rather than as the paper's own table.

What to do on Monday

Three things, in order of how badly they will bite you.

Audit what you have published. If your team has ever pushed an agent transcript, eval run, or benchmark trajectory to a public repo, the encrypted thinking blocks in it are recoverable content, not redacted content. Grep your history and rotate anything a key scanner would have flagged had it been readable.

Stop treating encrypted CoT as a privacy boundary. It is an IP boundary the vendor built for itself, and it never made you any promises. Scrub the blocks out of anything you log, ship, or share.

Assume reasoning holds more than the answer. A safe final output does not mean a safe trace, which matters for the compliance story you tell about what your agent processed.

Key Takeaways

• The flaw is architectural, not cryptographic. Encrypted reasoning blocks carried no binding to their session, account, or issuing model, so a weaker sibling accepted a flagship's ciphertext and transcribed it.
• 315,320 blocks were already public. Pulled from 6,708 agent trajectory datasets, they yielded 367 PII artifacts and 182 credentials, including 62 API keys and 33 passwords.
• Invisible prompt injection is the scariest vector. A payload inside the encrypted block never appears in your prompt or your logs.
• Two informal reports in May and June went nowhere. The bug bounty answers were "not reproducible" and "no security implications" until a paper made it undeniable.
• It is patched, and the archive is not. Server-side mitigations landed, but only key rotation touches ciphertext that is already on GitHub.
• Scrub thinking blocks from anything you publish. Treat them as plaintext you have not read yet.

Sources: arXiv 2608.09867, Stolen Thoughts project page, Hugging Face paper page, A Few Thoughts on Cryptographic Engineering, Will Smidlein, Simon Willison, Cyber Security News, Hacker News