Cross-Model Encrypted Reasoning Trace Decryption Jailbreak

Technical Analysis

Providers return encrypted opaque blocks representing hidden chain-of-thought to clients, who resend them on subsequent requests; the encryption/authentication scheme fails to bind these blocks to a specific session, user, or model instance. An attacker injects a captured encrypted block (their own or scraped from public logs) into a request to a less-safeguarded model from the same provider, which decodes and echoes the trace verbatim, bypassing intended safeguards on the stronger model. This crosses trust boundaries between models within a provider ecosystem and between end users, since any party possessing a block can force its decryption elsewhere. The same primitive allows payloads embedded in encrypted blocks to be smuggled into agentic tool chains and rollouts as invisible prompt injections that only manifest after decryption.

Detection Signatures

• Presence of unusually large or repeated opaque/base64-like encrypted reasoning blocks in shared session logs or public repositories
• Requests where an encrypted reasoning block from one session/user is replayed in a different session or against a different model tier
• Unexpected verbatim decrypted plaintext appearing in model output that does not match the visible final answer
• Sudden appearance of PII/credential patterns in decoded output blocks
• Agentic tool-call logs containing decoded content that alters downstream tool invocation without user-visible instruction

Remediation Steps

1. 1

   Bind reasoning blocks cryptographically to session/user/model

   Providers should include session ID, user ID, model version, and timestamp as authenticated associated data (AEAD) so blocks cannot be replayed across contexts.

2. 2

   Server-side storage of reasoning traces

   Avoid round-tripping raw encrypted reasoning through the client; store traces server-side and reference them by opaque non-decodable handles.

3. 3

   Reject cross-model/cross-session block reuse

   Implement server-side validation that rejects encrypted blocks not originating from the exact same conversation and model instance.

4. 4

   Scrub shared logs before publication

   Developers should strip or redact encrypted reasoning blocks from session logs before sharing publicly, since content is not visibly obvious as sensitive.

5. 5

   Re-apply safety filtering post-decryption

   Run safety/PII filters on any decoded reasoning content before it reaches agentic pipelines or is exposed to end users.