Paper Reveals Encrypted CoT Flaw Allowing Reasoning Theft from Top LLMs
Alexander Panfilov · hf · 2026-08-11
A new research paper reveals an architectural vulnerability in the encrypted chain-of-thought (CoT) blocks used by leading LLM APIs (e.g., OpenAI, Anthropic, Google) to protect proprietary reasoning. These blocks are fully compatible and interchangeable across different sessions, users, and models within a provider's ecosystem.
Exploiting this, researchers developed a scalable decryption jailbreak: by injecting an encrypted reasoning trace from a stronger model into a weaker, less safeguarded model within the same ecosystem, the weaker model can be forced to decode and output the trace verbatim in plaintext. This enables four major attack vectors:
- Anti-distillation circumvention: Allows adversaries to extract a proprietary model's hidden reasoning.
- Large-scale PII extraction: By decoding 315,320 reasoning blocks scraped from public developer logs, researchers recovered 367 PII artifacts and 182 credentials.
- Hazardous information exposure: Reveals dangerous hidden reasoning even if the model's final output safely rejects the malicious request.
- Invisible prompt injections: Attackers can embed malicious payloads entirely within encrypted blocks to poison public agentic rollouts.
Following responsible disclosure, the authors proposed concrete cryptographic and system-level mitigations.
Related event: Research Reveals Vulnerability in Encrypted Chain-of-Thought of Major LLMs(2 posts)→
More from Safety
- AI Text Watermarking Called Ineffective: Rewriting with Another AI Easily Bypasses It — miniapeur · 2026-08-11
- Researchers Expose API Flaw: Encrypted Chain-of-Thought in Major LLMs Can Be Stolen — dpaleka · 2026-08-11
- Claude Outputs Now Include Text Watermarks, Sparking Removal Discussions — Franck_Dernoncourt · 2026-08-11
- Anthropic's Watermark Deemed Short-term Fix; Expert Calls for On-chain AI Provenance — RileyRalmuto · 2026-08-11
- Researchers Pose as DeFi Startup to Hire and Expose North Korean Lazarus IT Workers — banteg · 2026-08-11
- The Real Threat of AI Agents: Incompetence Over Malice — bendee983 · 2026-08-11