Encrypted "thinking" blocks from OpenAI, Anthropic and Google can be decoded — and they leak real secrets

The strongest evidence isn't the leak count itself, it's the calibration check: across 120 Codeforces problems, the token count of the decoded reasoning tracks the hidden thinking-token count the API itself reports. That correlation is the thing that separates "we found some text" from "we recovered the actual hidden reasoning" — it's an independent signal (the provider's own token accounting) confirming the decode is faithful, not fabricated or hallucinated filler.

Encrypted reasoning was sold as a boundary: users can't see it, and therefore can't be exposed by it. This work shows that boundary is porous when the same encrypted blocks are captured and stored in agent trajectories that then get published publicly — a workflow that is already common practice for sharing agent demos and benchmarks. The API's own thinking-token accounting effectively becomes the key that makes the decode verifiable, which is an uncomfortable irony: the transparency feature meant to build trust in reasoning models is what confirms the leak is real.