A paper from researchers at ELLIS Institute Tübingen, the Max Planck Institute for Intelligent Systems, and Snyk shows that the encrypted reasoning blocks Anthropic, OpenAI, and Google return to API clients are not the protection they look like. The authors replayed a reasoning block produced by a frontier model into a weaker model from the same provider, jailbroke the weaker model, and recovered the stronger model's hidden reasoning in plaintext. The whole extraction takes two API calls. The thread on Hacker News passed 690 points and 300 comments within days (the discussion).
The part that matters is not the jailbreak. The part that matters is that your session logs, your agent traces, and your tool-call history are now a decryption surface you did not know you had.
What the encrypted block actually is
When you call a reasoning model, the provider hides the chain of thought. The part you see is the answer. The thinking in between is returned to you as an encrypted block, and your client stores it and sends it back with the next request in the conversation. The server never keeps it. That design choice is what makes the attack possible.
From the paper on arXiv:
