Reasoning-trace replay exposed a context-binding flaw
The study concerns encrypted AEAD envelopes and authorized-provider replay oracles; subsequent vendor defenses change the current threat picture.
The protected-reasoning study examines replay of encrypted reasoning blocks across sessions and model contexts. The paper treats them as AEAD envelopes. Its finding is a missing context-binding boundary, not base64 substituted for encryption or a break of the encryption primitive.
The authors decoded 315320 historical reasoning blocks and reported 367 personally identifying information artifacts and 182 credentials. Those are recovered-item counts, not counts of blocks containing those items. The corpus includes benchmark traces with synthetic personal data; the paper separately reports genuine-user findings. The extraction protocol and its provider/oracle access conditions must remain attached to these counts; they do not mean anyone can directly decrypt every block.
Anthropic’s October 12 distillation-defense report describes changes that prevent cross-account and cross-model protected-reasoning replay, along with classifier defenses and acknowledged limitations. The historical vulnerability and the vendor’s current mitigation are different facts. A vendor defense announcement is not independent proof that every related attack is eliminated.
Use the historical study to understand binding and access boundaries, then validate current documented provider behavior. The original security-theater and not-encryption characterization was inaccurate and has been removed.
Editorial correction (2026-10-13 UTC): Corrected the context-binding mechanism and added the current vendor mitigation.