Stealing Reasoning Traces Guide: Audit Your Logs

Is that encrypted thinking block in my agent log actually private?

Those long base64 “thinking” / “signature” fields next to Claude, GPT, or Gemini replies? Final answer looks clean. JSON looks scrubbed. Trajectory hits GitHub for a demo. Most teams stopped worrying there.

Mid-August 2026, Stealing Reasoning Traces from Proprietary LLM APIs (Panfilov et al., arXiv:2608.09867) showed the opposite. Client-side encrypted reasoning envelopes were recoverable as plaintext. HN’s shorthand stuck fast: treat them like cookies. Your agent logs were a decryption surface.

This piece is for people who ship agents or publish sessions – not a rehash of attack templates. Residual risk after the patch, plus a short audit you can finish this week.

Why “encrypt the chain-of-thought” still leaked

Providers quit shipping full plaintext reasoning years ago. Goals: blunt distillation, hide intermediate secrets, keep hazardous half-thoughts off the wire. State stayed off their servers. You got an opaque AEAD-style envelope (signature / thinkingSignature / encrypted_content) and had to echo it on the next turn. Stateless. Easy to scale.

The hole was binding – not the cipher. Same key material worked across a family. Blocks weren’t glued hard to one user, one session, or even the exact model that wrote them. Frontier trace in, weaker sibling out. Ask the cheap model to transcribe. No need to break the flagship’s refusals.

Fidelity wasn’t paraphrase theater. On 120 Codeforces-style problems, decoded length sat near the source’s billed thinking-token count (paper Figure 1) – basically y ≈ x up to generation limits. Weaker siblings were inexpensive oracles because they lacked the same anti-distillation refusals.

Think of the envelope like a session cookie you thoughtfully base64’d and committed “because it isn’t the password.” Same class of mistake. Portable secret material wearing a boring field name.

What public trajectories actually spilled

6,708 public agent trajectories off GitHub and Hugging Face. 315,320 reconstructed reasoning blocks. 367 PII artifacts. 182 credentials. In the genuine-user slice alone: 62 API keys, 33 passwords, 30 personal emails – plus tokens that never belonged in a gist.

The sting: 64 privacy artifacts from real sessions lived only inside the reasoning. Never in user text, assistant text, or tool output. Regex for sk- on the visible channel missed them. People who “sanitized” before publish still shipped secrets.

One design hole, four ways it hurt:

• Proprietary reasoning extraction – distillation without jailbreaking the frontier model.
• Third-party secret recovery – anyone with the published JSON could decode.
• Hazardous intermediates – safe final answer, unsafe monologue underneath.
• Invisible prompt injection – poison rides entirely inside the encrypted block; monitors see no plaintext instruction when an agent later replays stored state.

Responsible disclosure landed. As of August 2026 the cross-model replay path the paper showed no longer worked on live endpoints; providers acknowledged the report. Anthropic guidance (via contemporaneous write-ups) ties thinking blocks to the producing model and says strip them on switch. Old public logs? Still a problem. Your export habits going forward? Still a problem.

Pro tip: Reasoning / signature / encrypted_content fields get the same controls as live API keys. Same redaction, same “never commit,” same access scope. If you wouldn’t paste sk-... into a public gist, don’t paste the thinking block.

Audit your trails in under 30 minutes

Skip reproducing anything against production APIs. Find residue. Kill it.

1. Inventory exposure. Org GitHub, Hugging Face, internal mirrors: thinkingSignature, encrypted_content, signature, reasoning_block, thinking_blocks, fat base64 beside model JSON. The paper needed zero special access for thousands of trajectories – assume crawlers already saw yours if it was ever public.
2. Quarantine before you admire the JSON. Private or delete. “We’ll scrub Friday” is how keys stay indexed.
3. Rotate on suspicion. Every key, password, token, or identifier that session could have touched – visible or not. Pretend the envelope was already plaintext to a motivated reader.
4. Rewrite logging policy. Default: don’t persist full envelopes. Hard need only, encrypted at rest under your keys, tight ACL, never in eval exports or blog zips. Summarize or strip before share.
5. Harden restore paths. Agents that reload turns from storage should validate origin and drop blobs that cross session or tenant boundaries. Blind replay moves both secrets and invisible injection.
6. Re-read provider docs this month. Behavior moved after the paper; some clients still echo signatures like it’s 2025.

Want mechanics without touching vendor APIs? Community local-only simulations exist against OpenAI-compatible servers for the envelope/validation story. Research toy – not a live-provider pointer.

When the secret never hits the visible channel

Paper private-data notes are blunt: models restate live credentials inside reasoning while the user-facing transcript and “cleaned” files look fine. Redaction tools watch the plaintext channel. The monologue still names keys from earlier context, tool calls, or retained memory. Package that monologue into a portable blob, leave it in a public log, and confidentiality is gone for anyone who still has a historical decode path – or finds a remaining gap.

Does this push you toward thinner agent memory, or just a harder perimeter on what leaves the box? I’m still chewing on the observability trade.

Pro moves for anyone logging agents

Keep these:

• Default store: false (or equivalent) unless you truly need multi-turn reasoning continuity across restarts.
• Prefer provider-managed sessions over shipping full encrypted blobs through your own log pile.
• Public datasets and demos: strip envelopes. Base64 is not noise.
• CI rule: fail commits when characteristic long signature fields sit next to model response JSON.
• Frameworks: log tool calls and final answers; treat internal monologue as sensitive telemetry.

Nearby threads: how chain-of-thought prompting behaves under the hood, and trace-inversion work that synthesizes plausible reasoning from answers plus summaries. Same family – what an adversary learns from what you expose.

Decoded examples that make the density obvious: stolen-thoughts.com. Context on the disclosure window: Simon Willison’s Aug 2026 notes. Run the GitHub search on your orgs before you close the tab.

FAQ

Can I still steal reasoning traces from live proprietary APIs today?

No – not via the paper’s cross-model path. As of August 2026 those attacks stopped reproducing after provider mitigations. Past public logs are the open wound.

I already published trajectories with those blocks – what now?

A teammate once treated it like a committed .env: repos private within the hour, every credential rotated, then a post-mortem on the export script. Do that. Assume anyone who mirrored the repo could read the hidden reasoning. Fix the pipeline so the next share never includes envelopes.

Does stripping the blocks break multi-turn conversations?

Only if continuity depends on client-side replay of the exact encrypted thinking. Lots of stacks already use provider conversation IDs or a short summary on a fresh turn. After the paper, reported Anthropic guidance says strip thinking blocks on model switch – other models ignore them anyway. The old “always echo the signature into long-lived shared logs” habit is the foot-gun. Check current client defaults against today’s docs; don’t trust last quarter’s SDK sample.