The encrypted reasoning block is the side channel, not token timing

A site called Stolen Thoughts, published on 11 August 2026, demonstrates that the hidden reasoning of frontier models can be recovered verbatim. The method does not involve token timing, logprob inversion, or coaxing detail out of summarised thinking. It uses the encrypted reasoning block that providers already hand back to the client.

The authors collected 6,708 publicly available agent trajectories from GitHub and Hugging Face, produced by Claude, GPT and Gemini models and still containing encrypted reasoning blocks. Running their decoding pipeline over every signed block yielded 315,320 reconstructed reasoning blocks. Restricted to genuine, non-benchmark user sessions, that produced 704 distinct privacy artifacts, including 62 API keys, 33 passwords, 24 access tokens and 30 personal email addresses. Sixty-four of those 704 appeared only inside reasoning and nowhere in the visible session.

If you came looking for a statistical side channel, this is the correction: the leak is architectural. The block is signed, opaque to you, and replayable. That changes what a reasoning model's output actually is from an engineering standpoint.

Providers return a model's reasoning to the client as an encrypted block, which the client sends back to the server when the conversation continues. Stolen Thoughts shows these blocks are portable: they can be replayed outside their original context. Injecting one into a weaker, jailbroken model from the same provider makes that model emit the stronger model's raw reasoning.

The demonstration pairs a claude-opus-4-8 turn, whose thinking block carries a signature of roughly 36,180 characters, with a request to claude-haiku-4-5-20251001 that reuses the same signature and an empty thinking string. The follow-up user turn simply asks the model to transcribe the attached reasoning.

The same pattern is shown across providers. A GPT-5.2 Codex encrypted_content field is decoded with GPT-5.6 Luna. The authors say they demonstrate it on frontier models from OpenAI, Anthropic and Google.

Fidelity is measured rather than asserted. Across 120 Codeforces problems, they plot the hidden thinking-token count reported by the API against the token count of the decoded reasoning when fed back to the model as input, and report that the decoded reasoning closely tracks the reported hidden token count. That is a volume check, not a per-token equality proof, but it rules out the possibility that the decoded text is a short confabulated summary.

The 704 artifacts break down as 351 technical identifiers, 204 items of PII, 126 credentials and 23 other, alongside names, postal addresses and internal URLs. The published excerpt is a Terminal-Bench sanitize-git-repo task, where the model's private reasoning about removing secrets from a repository enumerates the secrets it found.

That trace goes on to list concrete values it located: an AWS-style key beginning AKIA, a ghp_ GitHub token, and hf_ Hugging Face tokens in a cluster YAML and a cached token file. The secrets a model handles while doing security work end up in the reasoning by construction. Any redaction pass that runs only on the visible assistant text misses them entirely, which is exactly what the 64 reasoning-only artifacts represent.

There is a client-side dimension too. Rafael's Lighthouse Newsletter piece on putting GitHub Copilot behind mitmproxy is a reminder of how low the bar is for seeing what a desktop AI client actually sends: install mitmproxy, trust its locally generated CA, and the single end-to-end TLS connection becomes two, with the proxy decrypting in the middle. That works because Electron apps route HTTP through Chromium's network stack or Node's fetch, both of which honour proxy configuration. Anything your extension or desktop agent puts on the wire, including reasoning blocks it is round-tripping, is visible on the machine it runs on.

The source does not describe how the weaker model was jailbroken, does not report whether any provider has changed signature validation in response, and does not give latency or cost figures for the decoding pipeline. It also does not claim that timing or logprob channels reconstruct reasoning — nothing in this material supports that, and treating those as the threat would be aiming at the wrong thing.

Worth watching separately: Shrivu Shankar's probing work shows that official APIs already leak structural facts about training, with an eight-way multiple-choice quiz over daily Wikipedia facts used to estimate pre-training cutoffs, and the observation that recent OpenAI models have the actual date injected into every request. Those are inference-time probes with no ground truth to verify against, and the author says so. The reasoning-block replay is different in kind: it does not estimate anything. It returns the text.