Stealing AI Reasoning Traces

Research reveals an architectural vulnerability in major LLM providers (Anthropic, OpenAI, Google) where encrypted chain-of-thought reasoning blocks are compatible across sessions and can be injected into weaker models to force decryption and plaintext disclosure. The exploit enables extraction of proprietary reasoning, large-scale private data recovery (315,320 blocks scraped; 367 PII artifacts and 182 credentials recovered), exposure of hazardous hidden content, and invisible prompt injection; authors propose cryptographic and system-level mitigations after responsible disclosure.