Study: 'Encrypted' AI Inference Blocks Can Leak Prompts and Credentials
Researchers show that encrypted inference blocks from multiple vendors are not bound to a session, user or model — and can be re-injected to recover hidden reasoning.
Encryption is supposed to mean that only the intended party can read a message. A paper released in August 2026 argues that in the world of AI inference, "encrypted" can mean considerably less than that.
The claim
The study, Stealing Reasoning Traces from Proprietary LLM APIs, examines what happens when a model's hidden reasoning is carried in opaque state objects — the kind of encrypted or signed artifacts that clients store and send back on later requests. The researchers showed that these objects are not always reliably bound to the session, user or model that produced them. A reasoning object captured from one context can be accepted in another — by a compatible model running the provider's own infrastructure.
If that second model can be induced to disclose what it interpreted, it effectively acts as a reasoning-decoding oracle: hidden chain-of-thought can be reconstructed, secrets embedded in agent traces can be recovered, and instructions can be injected through a channel the user cannot inspect. The team collected samples from public repositories to demonstrate the problem.
Why this is worse than it sounds
The interesting failure is not a conventional break of an encryption primitive. The researchers did not recover provider keys and decrypt ciphertext offline. They found something more structural: encrypted reasoning is being treated as harmless metadata when it is really sensitive, authenticated, context-dependent agent state.
Encrypted inference is sold as the answer to "how do I use a model without giving away my data?" If the artifact of a computation is portable — if nothing in the sealed object ties it to the conversation that produced it — then encryption protects the channel but not the content.
The honest caveat
One fact matters as much as the finding itself: the paper's authors state that the main attack demonstrated was no longer reproducible as of August 2026, after affected providers received the disclosures and deployed mitigations. The paper should not be read as evidence that the same extraction path is still open today. It should be read as evidence that reasoning state has become a security boundary in its own right.
For builders, the takeaway is to treat "encrypted" as one property among several — session binding, provenance and access control do the heavy lifting. For everyone else, it is a reminder that the word "encrypted" on a product label is a starting point, not a guarantee.
If an artifact can travel, encryption alone is not privacy. It is just a nicer envelope.