Researcher Finds ChatGPT, Claude ‘Encrypted Raw Reasoning’ Can Be Replayed Across Accounts
Matthew Green wrote in a blog post that ChatGPT and Claude can send users what he called “encrypted raw reasoning,” and that this data can be replayed across accounts. He said a poorly sanitized chat interface could let an attacker inject reasoning blobs into a chat agent so the model treats them as its own authenticated internal thoughts.
In a separate experiment, Green said the reasoning channel could also leak secret information through differences in computation length and complexity. In his test, a hidden bit of 0 produced a short computation, while a bit of 1 produced a much longer and more complex one, suggesting exposed reasoning data could create a path for information leakage.
From the sources (3 posts)
@matthew_d_greenLast week I discovered that ChatGPT and Claude will send you their “encrypted raw reasoning” and of course I immediately wasted a weekend trying to do something bad with it. What I got for my trouble was this blog post:
@matthew_d_greenOne thing I learned is that you can replay reasoning across accounts. So with a poorly sanitized chat interface, an attacker might inject their own reasoning blobs into the interface for a chat agent, and the model may see them as its own a
@matthew_d_greenThen I tried a different approach. I wanted to see if reasoning itself could leak secrets. So I told the model it had a secret bit it could not leak, then asked it to think about the secret. The trick was: if the bit was 0, the computation