--- title: "Recovering Encrypted LLM Reasoning Traces · Embrace The Red" url: https://daily.dev/posts/recovering-encrypted-llm-reasoning-traces-embrace-the-red-bf969iyaf source_url: https://embracethered.com/blog/posts/2026/recovering-encrypted-llm-thoughts type: article source: "Embrace The Red" published: 2026-08-17T04:04:08.065Z updated: 2026-08-17T13:23:44.364Z tags: ["security", "openai", "encryption", "prompt-injection"] reading_time: 7 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Recovering Encrypted LLM Reasoning Traces · Embrace The Red **[Embrace The Red](https://daily.dev/sources/embracethered)** · 7 min read · 0 upvotes · 0 comments ## Summary A researcher reproduces and extends a recently published attack that recovers encrypted LLM reasoning traces by replaying them to a different, more jailbreakable model. Testing against OpenAI's GPT-5.6 (Sol and Luna models), the technique worked across sessions and even separate accounts, successfully recovering a password embedded in a reasoning trace. The underlying paper decoded over 315,000 reasoning blocks scraped from public repos and recovered hundreds of PII items and credentials, suggesting encrypted reasoning blobs (found in Codex session files) should not be treated as harmless opaque data since providers appear to use shared encryption keys across users and models. The attack's reliability was inconsistent, working, then failing, then working again days later, with no clear explanation. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Can encrypted reasoning traces from OpenAI's GPT-5.6 be recovered by replaying them to a different model or account? Yes. An encrypted reasoning blob produced by one model, such as GPT-5.6 Sol, can be replayed to a compatible model like GPT-5.6 Luna from the same provider, even under a completely different account, and the receiving model can be jailbroken into transcribing the underlying reasoning content, including secrets like passwords that were part of the original reasoning. _Security teams evaluating AI tool risk can track LLM vulnerability research like this through daily.dev._ ### Why can encrypted LLM reasoning traces be replayed across different sessions and accounts? Providers appear to use shared encryption keys across users, sessions, and models, which means an encrypted reasoning trace leaked or shared by one person can potentially be decrypted and read by someone else using a different session or account. This was demonstrated on OpenAI's API and chatgpt.com backend endpoints using GPT-5.6 models. _Anyone weighing which AI vendor to trust with sensitive prompts can follow security findings like this on daily.dev._ ### What sensitive data was found in leaked encrypted LLM reasoning traces scraped from public repositories? Researchers decoded 315,320 reasoning blocks scraped from public repositories and recovered 367 pieces of PII and 182 credentials, including API keys and passwords, showing that encrypted reasoning blobs shared in session files or code repos can expose far more sensitive information than users realize. _Developers auditing what secrets end up in shared AI session logs can follow this kind of research on daily.dev._ --- Tags: [#security](https://daily.dev/tags/security), [#openai](https://daily.dev/tags/openai), [#encryption](https://daily.dev/tags/encryption), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/recovering-encrypted-llm-reasoning-traces-embrace-the-red-bf969iyaf)