Encrypted reasoning had an unexpected weak point: another model

Some model APIs return opaque reasoning blocks so clients can send them back when a conversation continues. The client cannot simply read them, but the service can.

The researchers found that blocks could travel across models within a provider’s family. A weaker sibling could then be induced to reveal reasoning produced by a stronger model. The attack exploited that portability rather than breaking the encryption directly.

Their study also examined publicly shared agent transcripts containing these blocks. It identified sensitive material in decoded reasoning, including information absent from the visible conversation. Publishing an apparently unreadable block was therefore not necessarily equivalent to removing the underlying content.

Simon highlights a second finding: attacker-influenced reasoning could be replayed into another model, which might treat it as trusted prior thinking. Confidentiality and instruction trust are separate problems here.

The researchers reported the issue to the providers and subsequently could no longer reproduce the same attacks. That is evidence of remediation for the reported methods; the broader design question is how tightly saved model state is bound to the context in which it belongs.