TL;DR: On August 10, 2026, researchers from MATS Research, the ELLIS Institute Tübingen, the Max Planck Institute for Intelligent Systems, and Snyk published arXiv 2608.09867, showing that the “encrypted” hidden-reasoning blocks returned by the OpenAI, Anthropic, and Google APIs could be replayed to a weaker model from the same provider, which would print the supposedly private chain-of-thought in plaintext. Decoding 315,320 reasoning blocks scraped from public repositories recovered 182 credentials and 367 PII artifacts (figures from the paper, relayed by multiple trackers). The providers mitigated the main attack within the month. A self-hosted Ollama or vLLM stack was never exposed, because the attack surface — provider-side reasoning blocks passed through client hands — does not exist locally.

	Cloud reasoning API (pre-mitigation)	Self-hosted Ollama / vLLM
Hidden reasoning exists?	Yes — returned as opaque/encrypted blocks	No — thinking tokens are plaintext to you
Who stores the trace	Provider infrastructure + every saved transcript	Your disk only
Could a third party decode it?	Yes, via the replay flaw (fixed Aug 2026)	Nothing to decode
Residual risk	Old transcripts in public repos	Exposed port 11434, device compromise

What was the 2026 cloud AI reasoning leak?

The leak was an architectural flaw, disclosed August 10, 2026, in how OpenAI, Anthropic, and Google protect the hidden reasoning their models produce. The paper, “Stealing Reasoning Traces from Proprietary LLM APIs” (arXiv 2608.09867), came out of a responsible-disclosure process with all three providers.

Reasoning models think before they answer, and all three vendors hide some or all of that thinking from the user — partly to protect it from distillation by competitors, partly because raw reasoning can contain content the polished answer would never show. To make multi-turn conversations work without storing state server-side, the APIs hand the reasoning back to the client as an opaque, encrypted block that the client returns on the next request. The researchers found that none of the three providers cryptographically bound those blocks to the model, session, or user that produced them. That single missing check enabled everything that follows.

The stateless design was not laziness. Zero Data Retention agreements — the thing enterprise customers demand for privacy — require that the provider keep no session state, which forces the reasoning to travel through the client. The privacy feature created the privacy hole.

As of late August 2026, the paper’s authors report the main extraction attack is no longer reproducible; the providers shipped mitigations after disclosure. No in-the-wild exploitation was documented. But any reasoning block committed to a public repository before the fix was decodable by anyone while the window was open.

How did the encrypted reasoning replay attack work?

The attack was a replay, not a cryptographic break. An encrypted reasoning block from a strong model (the kind you pay frontier prices for) was accepted as valid input by a weaker, cheaper model from the same provider. Fed someone else’s block, the weak model would decrypt it server-side as designed — and then, with simple prompting, repeat the contents in plaintext. No jailbreak of the strong model was ever needed.

Three properties made this work:

1. Portability across sessions and users. A block generated in your session validated fine in an attacker’s session.
2. Portability across models. A block from the flagship model validated on the budget model, which has weaker guardrails and lower per-token cost.
3. Blocks in the wild. Developers save raw API transcripts into logs, test fixtures, and agent-framework debug output, then push them to GitHub. The visible text looks sanitized; the encrypted blob next to it is invisible to a human reviewer. The researchers scraped 315,320 such blocks from public sources.

If you have ever saved a full Responses API or Messages API transcript, you have seen these blocks. They look like this (structure illustrative, field names real):

{
  "type": "reasoning",
  "encrypted_content": "gAAAABm9yZWFzb25pbmcgdHJhY2UgY29udGVudHMga...",
  "summary": []
}

Anthropic’s equivalent is the signature on thinking blocks and the data field on redacted_thinking; Google’s Gemini API uses thoughtSignature. Before the mitigation, each of these was a sealed envelope that any sibling model from the same vendor would open for whoever held it.

What could attackers do with stolen reasoning traces?

The paper demonstrates four abuse paths. Whether each one transfers to a self-hosted stack is the column that matters for this site:

Abuse path	What it means	Exists on cloud APIs	Exists self-hosted?
Distillation bypass	Harvest frontier reasoning chains to train a competing model, defeating anti-distillation controls	Yes (pre-fix)	N/A — open-weight reasoning is already public
Private data extraction	Decode blocks found in public logs; recover prompts, documents, credentials	Yes — 182 credentials, 367 PII artifacts recovered	No equivalent: traces never leave your machine
Hidden harmful content	Reasoning contains hazardous detail the visible answer refused to show	Yes (pre-fix)	Reduced: local thinking tokens are visible, so nothing is hidden from you
Invisible prompt injection	Attacker plants instructions inside an encrypted block your app replays	Yes (pre-fix)	No encrypted blocks to hide payloads in

The credential numbers deserve a pause. Those 182 credentials were not stolen from OpenAI’s servers — they were sitting in public repositories inside blobs that developers believed were opaque. The reasoning trace had slurped up API keys and passwords from the context the model was given (a .env file pasted for debugging, a config in an agent’s working directory), and the “encryption” was the only thing between that and the open internet.

Why a self-hosted stack never had this attack surface

A local inference stack has no hidden reasoning, no provider session log, and no encrypted block to replay — the entire attack maps to nothing. When Qwen3.8-27B or a DeepSeek R1 distill thinks on your machine, the thinking tokens stream to your terminal or your Open WebUI instance in plaintext, inside <think> tags you can read. They are stored in Open WebUI’s local database on your disk, or nowhere at all if you run ollama run in a terminal. There is no second copy on anyone’s infrastructure, no stateless-continuity blob, and no sibling model an attacker can replay anything to.

The trade is explicit: open-weight reasoning models have nothing to hide because the weights are public. What a cloud provider treats as crown-jewel IP — the reasoning chain — is, on your hardware, just output. The distillation attack is meaningless against you; the data-extraction attack has no transport to ride.

Hardware floor for a reasoning-capable local model, per our current canon: Qwen3.8-27B (Apache 2.0, Q4_K_M ~16.8 GB) on a single 24 GB card, or Gemma 4 12B QAT (~6.6 GB) on an 8 GB card. The GPU math lives on our sister site: GPU buying guide for local AI and best local models by VRAM.

Which parts of the leak still bite self-hosters?

Self-hosting the model does not self-host your habits. Three residual exposures are worth checking today:

Hybrid stacks still produce cloud reasoning blocks. If your LiteLLM or Open WebUI setup falls back to a cloud API for hard queries, those calls return reasoning blocks, and your logs now contain them. The mitigations stop the known replay, but the paper’s advice stands regardless: strip reasoning fields before any transcript leaves your machine.

Ollama’s cloud proxy models are cloud inference. Pulling one of the -cloud tagged models means your prompt — and the reasoning — executes on ollama.com’s servers, with all the session-log questions that implies. We covered the details in the Ollama cloud proxy models privacy guide.

Old transcripts don’t expire. Anything committed before August 2026 was decodable during the window. Audit your repos:

# find reasoning blocks in saved transcripts before committing
grep -rniE '"(encrypted_content|thoughtSignature|redacted_thinking)"' . \
  --include='*.json' --include='*.jsonl' -l

# strip reasoning fields from a transcript (jq 1.7+)
jq 'walk(if type == "object"
  then del(.encrypted_content, .thoughtSignature, .redacted_thinking, .thinking)
  else . end)' trace.json > trace.clean.json

Expected output of the grep: nothing. Every file it lists is a transcript that should not be pushed as-is.

Cloud reasoning leak vs an exposed Ollama port: which is easier to exploit?

For an attacker today, an exposed Ollama port is far easier — the cloud replay attack is patched, while misconfigured local stacks are being found by routine Shodan scans every week. The reasoning leak required research effort and is now mitigated; calling an unauthenticated API on 0.0.0.0:11434 requires one HTTP request, and tens of thousands of instances were already found exposed. The DNS-rebinding path demonstrated in CVE-2026-65105 (August 2026) didn’t even need an exposed port — a visited webpage was enough when Ollama was bound to all interfaces.

Thirty seconds of checking closes most of it:

$ ss -tlnp | grep 11434
LISTEN 0 4096 127.0.0.1:11434 ...   # good: loopback only
LISTEN 0 4096 0.0.0.0:11434  ...    # bad: whole LAN + rebinding surface

So the honest comparison: self-hosting eliminates the reasoning-trace surface by architecture, but replaces it with an operational surface that is entirely your job. Cloud providers patched their flaw in weeks; nobody patches your firewall for you.

When self-hosting does NOT protect your prompts

Four cases where the local-is-private argument fails, stated plainly:

• You still route sensitive queries to cloud APIs. A 27B local model is not a frontier reasoner. If your workflow sends the hard 10% to a cloud API, that 10% has the cloud threat model, mitigations or not.
• Your machine is the weak point. Local traces are plaintext on disk. Without full-disk encryption and a locked-down Ollama binding, you have traded a sophisticated attacker’s target for an easy one.
• Multi-user deployments centralize traces. A team Open WebUI instance stores every user’s conversations — thinking tokens included — in one database the admin can read. That is a policy question, not an encryption question, and pretending otherwise repeats the cloud providers’ mistake.
• Compliance needs more than locality. If you handle regulated data, “it never left the building” helps but does not substitute for access controls and audit logging. The self-hosted AI privacy stack guide covers the stack above the model.

FAQ

Was my data actually stolen in the reasoning leak? No in-the-wild exploitation was documented as of October 2026. The demonstrated harm was against blocks already public: 315,320 reasoning blocks scraped from public repositories yielded 182 credentials and 367 PII artifacts. If you never published raw API transcripts, your exposure was theoretical. If you did, rotate any secrets that appeared in those sessions’ context.

Is the flaw fixed now? The paper’s authors state the main extraction attack was no longer reproducible as of August 2026, after responsible disclosure to OpenAI, Anthropic, and Google. The underlying design — reasoning state traveling through client hands for Zero Data Retention compatibility — remains, with the paper proposing cryptographic binding of blocks to model, session, and user as the durable fix.

Do local models have hidden reasoning too? No. Open-weight reasoning models (Qwen3 family, DeepSeek R1 and its distills, Gemma thinking variants) emit their chain-of-thought as ordinary tokens, typically inside <think> tags. Ollama and llama.cpp show or fold them client-side; nothing is encrypted and nothing is retained anywhere you don’t choose.

Sources

• Stealing Reasoning Traces from Proprietary LLM APIs — arXiv 2608.09867 (Aug 10, 2026)
• The Hacker News: OpenAI, Anthropic, Google API Flaw Let Weaker AI Models Decode Stronger Models’ Reasoning (Aug 2026)
• Cloud Security Alliance research note: Encrypted Reasoning Traces Let Attackers Steal Hidden Chain-of-Thought (Aug 12, 2026)
• TechTalks: The silent data leak hidden inside encrypted reasoning traces of frontier AI models (Aug 17, 2026)
• Hugging Face papers mirror of 2608.09867

What self-hosting actually costs

Real cost breakdowns for self-hosted AI: hardware floors, power, maintenance hours, and the honest comparison against paying for it. No spam, unsubscribe anytime.

Email address Subscribe