A researcher reproduces and extends a recently published attack that recovers encrypted LLM reasoning traces by replaying them to a different, more jailbreakable model. Testing against OpenAI's GPT-5.6 (Sol and Luna models), the technique worked across sessions and even separate accounts, successfully recovering a password embedded in a reasoning trace. The underlying paper decoded over 315,000 reasoning blocks scraped from public repos and recovered hundreds of PII items and credentials, suggesting encrypted reasoning blobs (found in Codex session files) should not be treated as harmless opaque data since providers appear to use shared encryption keys across users and models. The attack's reliability was inconsistent, working, then failing, then working again days later, with no clear explanation.
Table of contents
BackgroundReproducing the AttackHow It WorksReliability During TestingConclusionReferencesAppendixQuestions this post answers
Can encrypted reasoning traces from OpenAI's GPT-5.6 be recovered by replaying them to a different model or account?
Yes. An encrypted reasoning blob produced by one model, such as GPT-5.6 Sol, can be replayed to a compatible model like GPT-5.6 Luna from the same provider, even under a completely different account, and the receiving model can be jailbroken into transcribing the underlying reasoning content, including secrets like passwords that were part of the original reasoning. Security teams evaluating AI tool risk can track LLM vulnerability research like this through daily.dev.
Why can encrypted LLM reasoning traces be replayed across different sessions and accounts?
Providers appear to use shared encryption keys across users, sessions, and models, which means an encrypted reasoning trace leaked or shared by one person can potentially be decrypted and read by someone else using a different session or account. This was demonstrated on OpenAI's API and chatgpt.com backend endpoints using GPT-5.6 models. Anyone weighing which AI vendor to trust with sensitive prompts can follow security findings like this on daily.dev.
What sensitive data was found in leaked encrypted LLM reasoning traces scraped from public repositories?
Researchers decoded 315,320 reasoning blocks scraped from public repositories and recovered 367 pieces of PII and 182 credentials, including API keys and passwords, showing that encrypted reasoning blobs shared in session files or code repos can expose far more sensitive information than users realize. Developers auditing what secrets end up in shared AI session logs can follow this kind of research on daily.dev.