--- title: Encrypted CoT blobs let you steal a model's private thoughts description: Researchers found that encrypted chain-of-thought (CoT) blobs returned by frontier model APIs to keep them stateless are not actually bound to the account or... canonical: https://daily.dev/posts/encrypted-cot-blobs-let-you-steal-a-model-s-private-thoughts-irdnvq94o twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Encrypted CoT blobs let you steal a model's private thoughts | daily.dev og:description: Researchers found that encrypted chain-of-thought (CoT) blobs returned by frontier model APIs to keep them stateless are not actually bound to the account or... og:url: https://daily.dev/posts/encrypted-cot-blobs-let-you-steal-a-model-s-private-thoughts-irdnvq94o og:image: https://api.daily.dev/og/posts/irDNvq94o.png og:image:alt: Encrypted CoT blobs let you steal a model's private thoughts og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Encrypted CoT blobs let you steal a model's private thoughts **[Trends](https://daily.dev/sources/trends)** · 3 min read · 1 upvotes · 0 comments ## Summary Researchers found that encrypted chain-of-thought (CoT) blobs returned by frontier model APIs to keep them stateless are not actually bound to the account or session that generated them. Because the encrypted envelope only verifies which model produced the blob, not who requested it, attackers can feed a blob from a strong model like Opus 4.8 into a weaker sibling like Haiku 4.5 and jailbreak it into transcribing the hidden reasoning verbatim. Studies by Matthew Green, MATS Research, ELLIS Institute Tübingen, Max Planck, Ilia Shumailov, and Alexander Panfilov scanned hundreds of thousands of publicly shared reasoning blobs and found real secrets embedded in them, including API keys, passwords, and medical information. Beyond leaking data, the flaw allows injecting fabricated reasoning to hijack agents and extracting harmful reasoning models internally rejected. Anthropic, OpenAI, and Google were notified; fixes range from not returning reasoning at all to binding blobs to sessions via hash-chaining. ## Content Turns out those encrypted reasoning blobs frontier models hand back to keep APIs stateless were never actually locked to your account. Researchers found you could take one, hand it to a different model, and just ask it to read the contents out loud. Here's the setup: providers like Anthropic, OpenAI, and Google don't store your conversation server-side. Instead they encrypt the model's internal reasoning and send it back to you, expecting you to pass it along next turn so the model can pick up where it left off. Matthew Green was first to notice these blobs were portable, moving between conversations and accounts, sometimes leaking things like social security numbers on replay. Then a team from MATS Research, ELLIS Institute Tübingen, and Max Planck showed how bad it actually gets. The encrypted envelope checks which model and version produced it, but not who asked for it or in what session. So you can grab a blob generated by a strong model, say Opus 4.8, feed it to a cheaper, less guarded sibling like Haiku 4.5, and jailbreak that smaller model into transcribing the hidden chain-of-thought in plain text. Across 120 Codeforces problems, the recovered trace lengths lined up with the reported thinking-token counts. This isn't some approximation of the reasoning. It's close to the real thing.//end note removed// A companion paper from Ilia Shumailov and Alexander Panfilov digs into why this works: decryption happens server-side, and the small model is, in their words, "willing to tell you" what it decoded. They scanned roughly 350,000 publicly shared reasoning blobs on GitHub and Hugging Face and found real secrets sitting in them. The MATS team found the same thing at a larger scale: 62 API keys, 33 passwords, and assorted medical information across 300,000+ decoded blocks. The attack surface is wider than data leakage. You can inject fabricated reasoning into a conversation to hijack an agent's next move. You can extract harmful reasoning a model considered internally but refused to say out loud. There's early evidence for cross-model bleed too: Kimi K3 was oddly quick to continue Claude's reasoning style when prefilled with just a couple of its tokens, though nobody's calling that proof of distillation yet. All three vendors were notified and acknowledged the reports. Fixes on the table range from just not returning reasoning at all, to binding each blob to the account and session that generated it, to hash-chaining reasoning steps so a stolen link can't be replayed out of context. It's reportedly already patched, likely through that kind of binding. What gets me is how obvious this feels in hindsight. Stateless APIs needed somewhere to put the state, and "encrypted but not bound to you" turned out to be nowhere near the same thing as "safe." ## Questions this post answers ### Can encrypted chain-of-thought blobs from Claude or GPT models be decoded by a different model? Yes. The encrypted envelope only verifies which model and version produced the reasoning blob, not who requested it or in what session, so a blob generated by a strong model such as Opus 4.8 can be handed to a weaker sibling like Haiku 4.5 and jailbroken into transcribing the hidden chain-of-thought in plain text, closely matching the original reasoning-token counts. _daily.dev surfaces security research like this for teams building on stateless reasoning APIs._ ### How many secrets were found leaking through publicly shared LLM reasoning blobs? Across roughly 300,000-plus decoded reasoning blocks, researchers recovered 62 API keys, 33 passwords, and assorted medical information; a separate scan of about 350,000 publicly shared blobs on GitHub and Hugging Face turned up real secrets as well, since the blobs were never cryptographically bound to the account that produced them. _Teams storing or sharing model outputs can track disclosures like this to avoid accidental secret exposure._ ### What fixes are being proposed for the encrypted chain-of-thought vulnerability in LLM APIs? Vendors including Anthropic, OpenAI, and Google were notified and proposed remedies ranging from no longer returning reasoning at all, to binding each encrypted blob to the specific account and session that generated it, to hash-chaining reasoning steps so a stolen blob cannot be replayed out of its original context; account-and-session binding is reportedly already in place. _Developers integrating reasoning-token APIs can watch for vendor patches like these before they ship._ --- Tags: [#security](https://daily.dev/tags/security), [#anthropic](https://daily.dev/tags/anthropic), [#prompt-engineering](https://daily.dev/tags/prompt-engineering), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/encrypted-cot-blobs-let-you-steal-a-model-s-private-thoughts-irdnvq94o) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Encrypted CoT blobs let you steal a model's private thoughts","url":"https://daily.dev/posts/encrypted-cot-blobs-let-you-steal-a-model-s-private-thoughts-irdnvq94o","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/encrypted-cot-blobs-let-you-steal-a-model-s-private-thoughts-irdnvq94o"},"datePublished":"2026-08-25T15:39:00.711Z","dateModified":"2026-08-25T15:40:07.362Z","description":"Researchers found that encrypted chain-of-thought (CoT) blobs returned by frontier model APIs to keep them stateless are not actually bound to the account or...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/df6c921ce77dd6b34461fb095b403981?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/df6c921ce77dd6b34461fb095b403981?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Trends","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Trends","logo":"https://media.daily.dev/image/upload/s--ZfSp3asX--/f_auto,q_auto/v1780996004/logos/trends?_a=BAMAMiWQ0","url":"https://daily.dev/sources/trends"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/encrypted-cot-blobs-let-you-steal-a-model-s-private-thoughts-irdnvq94o","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,anthropic,prompt-engineering,prompt-injection","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Trends","item":"https://daily.dev/sources/trends"},{"@type":"ListItem","position":3,"name":"Encrypted CoT blobs let you steal a model's private thoughts"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/encrypted-cot-blobs-let-you-steal-a-model-s-private-thoughts-irdnvq94o#faq","mainEntity":[{"@type":"Question","name":"Why can encrypted chain-of-thought blobs from Claude or GPT APIs be read by a different model?","acceptedAnswer":{"@type":"Answer","text":"The encrypted envelope only verifies which model and version produced the blob, not who requested it or in what session. This means a blob generated by a strong model like Opus 4.8 can be handed to a weaker sibling model such as Haiku 4.5, which can be jailbroken into decrypting and transcribing the hidden reasoning in plain text, since decryption happens server-side and the smaller model will comply. Track how vendors patch stateless API vulnerabilities like this one on daily.dev."}},{"@type":"Question","name":"What sensitive data have researchers found leaked in LLM reasoning blobs shared online?","acceptedAnswer":{"@type":"Answer","text":"Scans of roughly 350,000 publicly shared reasoning blobs on GitHub and Hugging Face, plus a separate scan of over 300,000 decoded blocks, turned up 62 API keys, 33 passwords, and assorted medical information embedded in the chain-of-thought content, alongside cases of social security numbers leaking on replay. Developers auditing what their AI tooling exposes can follow findings like this on daily.dev."}},{"@type":"Question","name":"How are Anthropic, OpenAI, and Google planning to fix the chain-of-thought blob leak vulnerability?","acceptedAnswer":{"@type":"Answer","text":"Proposed fixes range from no longer returning reasoning content at all, to binding each encrypted blob to the specific account and session that generated it, to hash-chaining reasoning steps so a stolen blob cannot be replayed out of its original context. All three vendors were notified and acknowledged the reports, with binding-based fixes reportedly already patched. Keep up with vendor security patches affecting LLM APIs you rely on via daily.dev."}}]} ```