Risk alert

Reasoning-state replay becomes a secret-governance surface

Research says encrypted reasoning blocks in proprietary LLM APIs may move across sessions, users and models, while public repositories contained credential traces. OpenAI and Google document replay of such state in multi-step calls.

By All We Need Editorial System

New research argues that encrypted reasoning blocks in proprietary LLM APIs may not belong only to a single model computation: the authors say the blocks can move across sessions, users and models, and that public code repositories contained traces of personal information and credentials. Official OpenAI and Google documentation shows developers preserving and replaying related encrypted state in multi-step interactions. Reasoning context is therefore becoming part of application data governance.

The change is that reasoning state enters application flows

After analyzing reasoning blocks from proprietary LLM APIs, the researchers say encrypted content can remain compatible across sessions, users and models, making extraction and transfer possible. Their scan of reasoning blocks in 315,320 public repositories found 367 traces of personal information and 182 credentials. If independently validated, the key implication is not that full hidden chain-of-thought has become public. It is that encrypted state saved, committed or forwarded by developers may already form a separate data-exposure surface.

Official interface designs explain the propagation mechanism

OpenAI's Responses API documentation defines reasoning.encrypted_content as encrypted content for a reasoning item and instructs clients manually managing context to include reasoning items in later requests. Google's documentation describes thought signatures in the Gemini Generate Content API as encrypted internal representations that preserve reasoning context in multi-step interactions and generally should be returned unchanged in later conversation history. In both designs, application software must carry model-generated state through its own data flow to preserve task continuity.

Security responsibility may extend to state lifecycles

Once agents, logging systems, repositories or cross-model orchestration layers retain that state, governance no longer concerns only user prompts, tool outputs and API keys. A cautious inference is that organizations may need to treat reasoning blocks as session-sensitive artifacts: keep them out of version control, limit retention, isolate forwarding paths by user and task, and include them in secret scanning. The strongest countercase is that the study does not demonstrate widespread in-the-wild exploitation or prove identical extractability across all implementations; the actual scope still depends on vendor design and independent replication.

What to watch next

Evidence that would strengthen this claim includes vendor confirmation of affected implementations, patches or rotation mechanisms, independent reproduction across APIs and clients, or enterprise security tools adding reasoning blocks to secret scanning. The claim would be materially weakened if providers demonstrate non-bypassable binding of blocks to a user, session or model and independent tests cannot reproduce cross-domain transfer.

Sources