⏱️ Lectura: 12 min
The team behind Stolen Thoughts achieved something no AI provider thought possible: transcribing, almost word for word, the encrypted and hidden reasoning of Claude, GPT, and Gemini. They did it without stealing any encryption key, just by reinjecting the same signed block into a weaker, jailbroken model from the same family.
📑 En este artículo
- TL;DR
- What Happened
- Context and History
- Technical Details and Performance
- How to Protect Yourself: Audit Your Traces Before Publishing
- Impact and Analysis
- What’s Next
- Frequently Asked Questions
- What exactly is Stolen Thoughts?
- Does this mean my normal conversations with a chatbot are exposed?
- Why isn’t reasoning sent directly in plain text if it can be decoded anyway?
- How do I know if I’ve already published traces with exposed encrypted reasoning?
- Do providers consider this a security vulnerability?
- What should I do if I find a leaked API key in a public trace?
- References
The finding didn’t stay in the lab. By applying the technique to 6,708 public AI agent trajectories on GitHub and Hugging Face, the researchers reconstructed 315,320 reasoning blocks and found 704 real secrets inside them, including 62 API keys and 33 passwords.
TL;DR
- Stolen Thoughts decodes the encrypted reasoning of Claude, GPT, and Gemini by reinjecting the signed block into a weaker, jailbroken model from the same family.
- The researchers processed 6,708 public AI agent trajectories from GitHub and Hugging Face that still had encrypted blocks attached.
- The pipeline reconstructed 315,320 reasoning blocks from those traces.
- Restricting to real sessions (not benchmarks), they found 704 privacy artifacts: 62 API keys, 33 passwords, 24 access tokens, and 30 personal emails.
- 64 of those 704 secrets existed only within the hidden reasoning, without appearing in the visible conversation.
- In an earlier tally from the project, 351 leaked elements had already been counted: 204 technical identifiers, 126 PII data points, and 23 credentials.
- The technique was demonstrated on frontier models from Anthropic, OpenAI, and Google, with the decoding closely tracking the hidden thinking token count reported by the API.
What Happened
The major reasoning model providers (Claude with extended thinking, GPT with its reasoning models, Gemini with thinking config) return an encrypted thinking block to the client along with the visible response. That block travels back to the server when the conversation continues, but in theory no one outside the provider can read its content: they only see encoded text and a long cryptographic signature.
The Stolen Thoughts team showed that this opacity doesn’t mean the block is tied to its original session. They took the signed block from a turn generated by a strong model (for example, claude-opus-4-8 solving a factorization problem) and reinjected it as prior context into a weaker model from the same family, which they first jailbroke with an instruction asking it to literally transcribe the reasoning attached to that turn. The weaker model, unable to verify where that block actually came from, complied and returned the original reasoning almost word for word.
They repeated the experiment with a real agent case: a trace of GPT-5.2 Codex running a Terminal-Bench task to sanitize an API key repository. By decoding the encrypted block with GPT-5.6 Luna, they recovered the complete internal reasoning, including the search patterns and step-by-step decisions the strong model made while identifying real credentials in the repository.
Context and History
Providers began encrypting and signing reasoning blocks for two stated reasons: to prevent third parties from distilling a proprietary model’s reasoning style by copying its chains of thought, and to allow the client to forward the block without being able to alter it, which serves as an integrity control in multi-turn conversations with tools.
That design implicitly assumed encryption also worked as a confidentiality boundary: if no one can read the content, it doesn’t matter that the client holds it or that it ends up accidentally published in a repository. Stolen Thoughts breaks that assumption by showing the signature doesn’t anchor the block to a specific user, session, or conversation. It’s portable: it can be extracted, saved, and reused in any other context where the provider accepts it.
The underlying phenomenon (AI agents publishing their complete execution traces to open repositories for reproducibility or benchmarking) has also been growing. Platforms like Hugging Face and GitHub accumulate thousands of these logs as a byproduct of automated evaluations, and until now no one audited them, assuming the encrypted reasoning field was, by definition, unreadable.
How Reinjection Works, in Simple Terms
The encrypted reasoning block isn’t just hidden text: it comes with a signature the provider can validate. When a client forwards that block in a later turn, the server recognizes it as legitimate and continues the conversation as if the model remembered having reasoned through it. Stolen Thoughts exploits exactly that mechanism, but points the block at a different model (cheaper, with fewer filters) instead of the model that originally generated it.
💭 Key takeaway: the cryptographic signature of a reasoning block doesn’t tie the content to the original session: it’s portable and can be reproduced out of context.
Technical Details and Performance
To validate that the decoded text was faithful to the real reasoning (and not a hallucination from the weak model inventing something plausible), the researchers ran the experiment against 120 Codeforces problems per provider and compared two figures: the number of hidden thinking tokens the API itself reports having used, against the number of tokens in the decoded text when the block is reinjected. According to their description, both numbers closely track the same trend, suggesting the weak model isn’t fabricating content but recovering the original reasoning almost in its entirety.
| Provider | Strong Model (reasoning source) | Jailbroken Weak Model (decodes) | Reported Result |
|---|---|---|---|
| Anthropic | claude-opus-4-8 | claude-haiku-4-5-20251001 | Transcribes the factorization reasoning inside a <thinking-copy> tag |
| OpenAI | GPT-5.2 Codex | GPT-5.6 Luna | Decodes the reasoning from a Terminal-Bench task on API key sanitization |
| Gemini reasoning model (no specific identifier given in the source) | Jailbroken Gemini variant | The authors claim to have reproduced the technique with the same methodology, without publishing the exact model pair |
At corpus scale, the pipeline processed 6,708 public agent trajectories produced by Claude, GPT, and Gemini models that still had encrypted reasoning blocks attached. From those, 315,320 reconstructed blocks emerged. Restricting the analysis to genuine user sessions (discarding benchmark runs), the team recovered 704 distinct privacy artifacts: 62 API keys, 33 passwords, 24 access tokens, and 30 personal email addresses, plus names, postal addresses, and internal URLs. In a separate count from the project, 351 leaked elements had already been identified, broken down into 204 technical identifiers, 126 PII data points, and 23 credentials.
The figure that should worry any team publishing agent traces the most: 64 of those 704 secrets existed only within the hidden reasoning. They weren’t in the visible prompt, the final response, or any other field of the log. Encryption was literally the only thing protecting them.
How to Protect Yourself: Audit Your Traces Before Publishing
If your team publishes agent logs, fine-tuning datasets, or benchmarking examples that include the encrypted reasoning field (thinking, reasoning, or similar depending on the provider), treat it like sensitive plain text, not like an opaque field that’s safe to share. The first step is auditing what you’ve already published.
1. Detect Long Encrypted Blocks in Your Files
Before scanning for secrets, it’s worth counting how many reasoning blocks you’re about to publish. An encrypted signature is usually a base64 string of thousands of characters inside the signature field:
grep -o '\"signature\":\"[^\"]\{200,\}\"' agent-trajectories.jsonl | wc -lThat command counts how many entries in your .jsonl file have a signature block longer than 200 characters, a clear sign that full encrypted reasoning is being carried there.
2. Scan for Secrets with Dedicated Tools
Install gitleaks according to your operating system:
# Windows (PowerShell, with scoop)
scoop install gitleaks
# macOS (Homebrew)
brew install gitleaks
# Linux (Debian/Ubuntu, binary)
curl -sSL https://github.com/gitleaks/gitleaks/releases/latest/download/gitleaks_linux_x64.tar.gz | tar -xz
sudo mv gitleaks /usr/local/bin/Then run the scan on the directory where you store your agent traces:
gitleaks detect --source ./agent-trajectories --report-path secrets-found.jsonThe JSON report lists each match with the file, the line, and the type of secret detected (API key, token, database credential). Any finding inside the reasoning field counts the same as one in visible code.
3. Redact the Reasoning Field Before Publishing
If you’re going to share traces for reproducibility but don’t need the encrypted block itself, the simplest option is to remove it before uploading the file:
import json
with open("agent-trajectories.jsonl") as entrada, open("clean-trajectories.jsonl", "w") as salida:
for linea in entrada:
registro = json.loads(linea)
for mensaje in registro.get("messages", []):
contenido = mensaje.get("content")
if isinstance(contenido, list):
mensaje["content"] = [
bloque for bloque in contenido if bloque.get("type") != "thinking"
]
salida.write(json.dumps(registro, ensure_ascii=False) + "\n")This script removes every block of type thinking from the trace before saving it, so the file you upload to a public repository no longer carries encrypted reasoning that someone could decode later.
⚠️ Warning: publishing AI agent traces on GitHub or Hugging Face without cleaning the encrypted reasoning field can leak secrets that don’t even appear in the visible conversation.
Impact and Analysis
The finding upends a design assumption shared by Anthropic, OpenAI, and Google: that encrypting reasoning is, besides protecting intellectual property, a de facto confidentiality barrier for whatever the model “thought” along the way. Stolen Thoughts shows that barrier depends on no one having access to a jailbroken weak model from the same family, something that’s trivial to obtain in practice.
The exposure vector isn’t the API itself, but the ecosystem of public datasets and traces surrounding agent development. Every evaluation framework, every reproducible benchmark, and every demo published as “look how my agent solved this” is potentially a file with encrypted secrets waiting to be decoded by anyone who replicates the technique.
It also reopens the question of how isolated hidden reasoning really is from the rest of the system. If a block signed by claude-opus-4-8 can be processed by claude-haiku-4-5-20251001 without the server detecting anything anomalous, the cryptographic signature is validating that the block is authentic, not that it belongs to the correct session or user.
What’s Next
In the short term, the three providers mentioned are likely to adjust how they validate these blocks: tying the signature to a conversation or user identifier so a block stolen from one session can’t be used in another, or simply refusing to accept reasoning blocks reinjected from outside the immediately preceding turn. None of the three had publicly confirmed a change of this kind as of this article’s publication.
At the same time, platforms like Hugging Face and GitHub are likely to start receiving takedown requests for datasets containing unsanitized agent traces, and specific scanning tools for the encrypted reasoning field are likely to emerge, beyond the generic secret scanners that already exist today.
📖 Summary on Telegram: View summary
Try it yourself: run gitleaks detect on the last agent trace dataset you published or downloaded, and check whether any reasoning block slipped through unclean.
Frequently Asked Questions
What exactly is Stolen Thoughts?
It’s a research project that demonstrates how to decode the encrypted reasoning returned by Claude, GPT, and Gemini models, by reinjecting the signed block into a weaker, jailbroken model from the same family, without needing to break the encryption itself.
Does this mean my normal conversations with a chatbot are exposed?
The documented risk is concentrated in AI agent traces published publicly (on GitHub or Hugging Face) that still include the encrypted reasoning block. A private conversation that’s never published isn’t exposed through this route.
Why isn’t reasoning sent directly in plain text if it can be decoded anyway?
Encryption still serves its original purpose: preventing a third party from reading the reasoning just by intercepting traffic or opening the file. Stolen Thoughts doesn’t break the encryption, it exploits the fact that the signed block is accepted by another model from the same family.
How do I know if I’ve already published traces with exposed encrypted reasoning?
Look for the thinking or reasoning field with a long signature in your .jsonl files, and run a secret scanner like gitleaks on those files, as detailed in the “How to Protect Yourself” section of this article.
Do providers consider this a security vulnerability?
The original source doesn’t report an official response from Anthropic, OpenAI, or Google as of this publication. The finding is framed as security research into the design of encrypted reasoning blocks.
What should I do if I find a leaked API key in a public trace?
Rotate that credential immediately, even if the file has been public for a while. Once a secret is exposed in a public repository, you need to treat it as compromised, regardless of how many people may have actually seen it.
References
- Stolen Thoughts: the original source of the research, with figures on trajectories analyzed, blocks reconstructed, and privacy artifacts found.
- Anthropic Documentation: official reference on how extended thinking and signed thinking blocks work in the Claude API.
- gitleaks: open source tool used to scan repositories and datasets for leaked secrets.
- detect-secrets: an alternative secret scanner maintained by Yelp, useful for auditing agent traces before publishing them.
📱 Enjoying this content? Follow @programacion on Telegram for daily tech content in Spanish: quick summaries, fresh content every day.
0 Comments