Encrypted Reasoning Traces in Proprietary LLM APIs Expose Credentials
Researchers discovered that encrypted reasoning blocks returned by proprietary LLM APIs can be replayed in jailbroken weaker models to extract raw thinking traces verbatim. Analysis of public agent trajectories revealed hundreds of exposed API keys and credentials.
Impact: High
Why it matters
Audit your agent trajectories and sanitize prompts immediately to prevent sensitive credentials from leaking through encrypted reasoning payloads.
TL;DR
- 01Encrypted reasoning blocks returned by LLM APIs can be decrypted by replaying them into weaker models
- 02Analyzed trajectories exposed 704 privacy artifacts including 62 API keys and 33 passwords
- 03Sanitize prompts and code context before sending data to agentic LLM pipelines
Key facts
- Trajectories Analyzed
- 6,708
- Reconstructed Reasoning Blocks
- 315,320
- Privacy Artifacts Found
- 704
- API Keys Exposed
- 62
Reasoning Trace Leakage via Block Injection
Frontier LLM APIs return hidden thinking traces inside signed, encrypted blocks. These payloads maintain state across conversation turns. However, because signatures are portable, injecting a signed block into a jailbroken model variant decrypts the exact internal reasoning verbatim.
Extracted Credentials from Public Trajectories
In an evaluation of 6,708 public agent trajectories, researchers extracted 315,320 reasoning blocks. The analysis uncovered 704 privacy artifacts, including 62 API keys, 33 passwords, and 24 access tokens. Developers frequently assume encrypted blocks safely obscure context, but sensitive data passed in prompts persists inside model thinking traces.
Try it in 2 minutes
grep -RIn -E "AKIA[0-9A-Z]{16}|ghp_[a-zA-Z0-9]{36}|hf_[a-zA-Z0-9]{34}" ./agent_logs/bash
✓ When to use
- When auditing security posture and log retention policies for agentic applications
- When red-teaming LLM APIs and verifying reasoning token boundaries
What to do today
- Audit GitHub and Hugging Face repositories for exposed agent trajectory logs containing encrypted thinking blocks
- Implement client-side sanitization to strip API keys, secrets, and environment variables prior to sending prompts to agentic models
What the community says
“LLM does not work on encrypted tokens. It happens at the API gateway.”
“We have its actual reasoning traces, and we have these psudotraces, distribution / nativeness is testable now”
Sources