- đź’ˇ The threat model most of us got wrong: providers hand you encrypted chain-of-thought blocks to replay on later turns, and this research shows those blocks are interchangeable across sessions, users, and even sibling models in the same ecosystem.
- 🎯 Two API calls, no direct attack: take a strong model’s encrypted trace, replay it into a weaker sibling from the same provider, jailbreak the weak one, and it decodes the strong model’s hidden reasoning in plaintext — the anti-distillation safeguards never fire because you never touched the strong model.
- ⚠️ This isn’t only IP theft: the authors recovered 367 PII artifacts and 182 credentials from 315,320 reasoning blocks scraped out of public repos, because people paste session logs without knowing what lives inside the opaque blob.
- 🔍 Invisible prompt injection: a payload can live entirely inside an encrypted block, poisoning agentic rollouts that later get shared and replayed downstream — a supply-chain problem for anyone building on public traces.
- ⚡ The operational takeaway: if you run agents on proprietary APIs, treat chain-of-thought as readable until the provider binds each block to a session and a user. An encrypted field you can’t inspect is not a trust boundary, and reasoning traces are now part of your data-governance surface.
The HN discussion and the wider write-ups are landing hard on the “encryption isn’t safety” point. explainX calls the scheme done poorly across all three providers and leads with the leaked PII and credentials; MagicTools hits the same nerve — secrets that surfaced only inside the reasoning blocks, never in the visible output. Simon Willison is the calmest of the three: he calls the cross-model replay “neat,” flags the prompt-injection variants as the scarier finding, and notes the providers appear to have already patched the reuse. The trend is a field realizing that “hidden” reasoning was a client-side promise, not a cryptographic one.