Encrypted AI traces can still contain sensitive information
Researchers recovered sensitive data from published reasoning blocks. Treat agent traces as potentially confidential before sharing them.
The cover image is an AI-generated editorial illustration. Screens and documents are illustrative concepts.
Encrypted content in a log is not a reason to publish the log. In Stealing Reasoning Traces from Proprietary LLM APIs, researchers describe replaying encrypted reasoning blocks through compatible models to recover their contents. The August preprint reports finding personal information and credentials in blocks collected from public repositories.
This was an attack on how the blocks could be reused, not a conventional breaking of the encryption. It challenges the assumption that an unreadable field is safe to share.
Review the whole trace
An agent transcript may contain more than the messages a person sees in the interface. Tool results, attached files, internal context and opaque fields can all carry information from the task.
We recommend deciding what needs to be shared before exporting a session. A minimal example with synthetic data is often enough to explain a bug. Publishing the complete working trace gives the recipient substantially more material to inspect.
Do not rely on a secret scanner as the only check. A scanner finding nothing in an opaque block does not establish that the underlying content contains no secrets.
If a trace is already public
Identify which sessions were published and what information those sessions could access. Restrict further sharing while you assess the exposure. Where credentials may have been disclosed, follow your incident process for revocation, replacement and review of use.
Removing a file from the latest commit does not remove existing copies or the repository’s history. The response should account for that, without assuming that every published trace has been exploited.
For future debugging and research, establish a separate export process. Keep the private working record where it belongs and produce a reviewed example for sharing. It is easier to make that distinction before a public push than after somebody notices a sensitive field.
