The encrypted reasoning blobs your secret scanner can't read
- Source
- x.com
- Date
AI labs hide the model's scratchpad (reasoning), then send you an encrypted copy so the next turn can continue. Public agent logs hid 315,320 of those copies. Cleaning the chat never opens them, and password scanners scored 0. A research paper decoded those copies from 6,708 posted agent sessions. 4.9% of those sessions (328) leaked at least one real secret. We ran five password-style regexes on a fake session that held three long envelopes labeled FAKE. > Chat cleaned, envelope stayed > 64 artifacts never in chat > Writing laptop still holds them We grepped Claude Code and Codex folders used for research and content writing. Counts only. We did not read the blobs. Zero Data Retention still leaves the unread copy on the client. One AWS page calls the same field a hash. What is actually inside that sealed copy? What do you strip before git, evals, or a zip? Does Bedrock make the laptop copy go away? Full Breakdown ↓↓
What is actually inside that sealed copy? Anthropic's docs call that field "an encrypted copy of the full reasoning that you pass back unchanged." OpenAI ships it as encrypted_content when store is false or Zero Data Retention. https://t.co/mzquj3jIg3
Context
An encrypted reasoning field can carry information beyond the visible conversation. Anthropic's API documentation describes thinking blocks whose signature clients must return unchanged, so the server can reconstruct the earlier reasoning in later turns.
Researchers reported recovering sensitive information by replaying such records through compatible models using providers' APIs. In their collection of 6,708 public sessions, 328 contained at least one reported real sensitive item. Cleaning visible text alone could therefore leave information in the retained reasoning records. The authors could not verify exact reconstruction of every hidden trace, and they report that the same attacks stopped working after disclosure to providers. Their recommendation is to strip opaque reasoning fields before publicly releasing logs that encountered private information.
- AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
Checking sign-in…
Loading comments…