Researchers decode encrypted LLM reasoning blocks from public repos, recovering PII and credentials

A paper reports that it decoded 315,320 encrypted reasoning blocks scraped from public repositories and recovered 367 pieces of personally identifiable information and 182 credentials.

The authors say reasoning traces can expose hazardous content even when a model's visible output refuses a malicious request. Paige Bailey shared commentary on the paper on X, and the paper warns that attackers could hide prompt injections entirely within encrypted blocks to poison public agentic rollouts. The paper's warning rests on the premise that developers often publish session logs without knowing what their encrypted blocks contain.