AI 'thinking' is often encrypted to keep it private, but it may be full of your own data.

This explores what sensitive material ends up inside the hidden 'thinking' that providers encrypt, and whether the encryption keeps it private. The corpus says the main content is the user's own data: the sensitive details from the prompt and context that the model repeats to itself while it works. It also says the encryption is weaker protection than it sounds.

The main mechanism is plain recollection. One study finds that 74.8% of privacy leaks in reasoning traces come from the model materializing sensitive user data as it thinks, not from clever inference Do reasoning traces actually expose private user data?. Longer reasoning chains leak more. Anonymizing a trace after the fact also makes the model perform worse, which suggests the private details act as scaffolding the model uses to think. An encrypted trace is therefore a place where user data is copied in bulk, and it is hard to strip out without hurting the answer.

The encryption doesn't seal that data in as firmly as you'd hope. Providers hand encrypted reasoning blocks back to clients, and those blocks are interchangeable across models and sessions within the same provider. A weaker, less-safeguarded model can decode a stronger model's trace and output it verbatim Can cheaper models decrypt traces from stronger models?. That work framed the attack as a way around anti-distillation protections. The same route also allows large-scale extraction of whatever private data sits inside the hidden reasoning. Two kinds of secret are exposed at once: the provider's proprietary reasoning, and the user's data embedded in it.

Two neighbouring findings add context. A reasoning model's raw thinking trace works as a compact stand-in for its context and beats most dedicated compression methods Can a reasoning model's thinking trace compress context effectively?. That note doesn't test privacy, but it hints that a trace carries a condensed copy of what the model was given, which would make it a dense target. For proving what an agent did without exposing traces, one approach anchors cryptographic commitments instead of content Can commitments protect sensitive agent data while enabling verification?. That separates proof from disclosure, but the organization must keep the content itself and faces hard questions about deletion and access control.

The corpus doesn't itemize categories of private information, such as names, health details or financial records. It only establishes that whatever sensitive data the model was given tends to reappear in its reasoning, and that encryption alone doesn't reliably keep it there.