The Thinking Block Your AI Client Saved Is Not Opaque — and It Holds Things You Never Saw

Your AI client is writing a second file alongside your visible session. It holds the model's reasoning in a form that looks sealed but is not. A researcher at Johns Hopkins measured it in May 2026, and a team of eight researchers measured it in a corpus of 6,708 trajectories and found things inside the reasoning blocks that had never appeared in the visible session at all.¹²

That is the fact this post explains. The follow-on question — what is in yours, on your disk, right now — is one you can answer yourself in about thirty seconds.

On the test machine used to prepare this post, 18,280 thinking blocks are saved across 878 session files.³ Every one of them carries a signature — the vendor's term for the encoded reasoning the model handed back to the client. Of those 18,280 blocks, 17,477 (95.6%) have an empty visible thinking field: no text you can read, no summary, nothing.³ The reasoning is gone from the surface. The signature is still there. Across all 18,280 blocks combined, the signature fields hold 41,249,028 characters of encoded content — roughly 71.8 times the volume of the visible thinking text that survived.³ The block is not empty. It is opaque by design, not by accident, and the opacity is a formatting property, not a privacy guarantee.

This piece sits next to two others in this corpus. "Recover Your Work from the AI Tool's Session Files" maps every vendor's session-file location and explains the transcript as an asset to back up.⁴ "Secrets Do Not Belong in Notes an AI Reads" covers input-side hygiene — keeping credentials out of the context the model sees.⁵ This post is the third vertex: what the model itself wrote into the output, in the file your client saved, and why input hygiene does not fully cover it.

What the block actually is

Anthropic, Google, and OpenAI all return reasoning to the client as an encrypted block rather than storing it server-side. The client sends that block back with every subsequent request. The block carries the model's hidden chain of thought so the server can reconstruct the reasoning context on the next turn — the client passes it along without reading it.

Anthropic documents the artifact directly: "Each thinking block also carries a signature field, an encrypted copy of the full reasoning that you pass back unchanged in multi-turn and tool-use conversations."⁶ On the newest models, the visible thinking field is omitted by default — the field is returned empty — but the signature still travels with the response and is still saved by the client. Anthropic states this plainly: "thinking blocks are returned with an empty thinking field. The signature field still carries the encrypted full thinking for multi-turn continuity."⁶ The instruction to developers is equally plain: "The signature field is opaque: don't interpret or parse it."⁶

Google's Gemini API documentation uses the same architecture. Thought signatures are described as "encrypted representations of the model's internal reasoning" required to "maintain reasoning continuity across multi-turn interactions."⁷ The signature field is marked Required: Yes — "an encrypted representation of the model's internal reasoning state. Always present, even when the model performs minimal reasoning."⁷ The summary field, the human-readable version, is Required: No, and "may be empty depending on the thinking_summaries config."⁷

OpenAI's Responses API follows the same pattern. "When you create a response in stateless mode, reasoning items in the response's output array include an encrypted_content property by default."⁸ The visible reasoning tokens are not exposed; a summary is available but is a separate, optional object.

Three vendors. One structural decision: the reasoning leaves the server, lands on the client, and the client holds it in a file on disk.

Portability: the finding that matters for the file on your disk

Cryptographer Matthew Green — professor at Johns Hopkins and the author of A Few Thoughts on Cryptographic Engineering — published the first careful look at these blocks on 2026-05-29.² His finding, which the corpus paper that followed builds on explicitly, is that the blocks are portable: they can be replayed outside their original context, across sessions and — as the later paper demonstrated — across users and models.

Green described the architecture this way: "Encrypted reasoning lets the provider return hidden model state to the client in a form the client can't read or modify, but can later replay so the provider can verify/decrypt it and continue a reasoning process."² He also confirmed the opacity in practice: "The API documentation informs us that this data contains opaque reasoning, and that you're not meant to look at it; you're just supposed to ship it back to the server on the next turn."²

Green's own attempt to read or modify the blocks directly failed. His conclusion: "the cryptography mostly seems to protect them. Although we can look at the blocks, none of the fields they contain seem readable or malleable. Believe me, I tried."² What he found instead was that the same signed blob could be replayed into a different model, a different user's session. That portability is what the later corpus paper turned into a measurable privacy surface.

Anthropic's documentation confirms portability as an intended property: "signature values are compatible across platforms (the Claude API," Bedrock, and Vertex).⁶ The block was designed to travel. That design is also what makes the file on your disk more than a dead archive — it is a live artifact, valid for replay, until you delete it.

What the corpus found in 6,708 real trajectories

A team of eight researchers from MATS Research, ELLIS Institute Tübingen, Max Planck Institute for Intelligent Systems, Tübingen AI Center, Snyk, and the University of Tübingen published a preprint at stolen-thoughts.com in 2026, building directly on Green's portability finding.¹ They collected 6,708 publicly available agent trajectories from GitHub and Hugging Face — sessions produced by Claude, GPT, and Gemini models that still contained their encrypted reasoning blocks.¹

Their method: replay the signed block into a weaker sibling model, jailbreak the weaker model, and recover the stronger model's hidden reasoning in plaintext. In their words: "We take a trace produced by a frontier model, replay it into a weaker sibling, jailbreak the weaker model, and recover the stronger model's hidden reasoning in plaintext, without ever attacking the stronger model directly or triggering its anti-distillation safeguards."¹

Applied to the corpus, the pipeline yielded 315,320 reconstructed reasoning traces across the 6,708 sessions.¹ Among genuine, non-benchmark user sessions, they recovered 704 distinct privacy artifacts — including 62 API keys, 33 passwords, 24 access tokens, 7 private keys, 30 personal email addresses, and 6 non-localhost IP addresses, alongside 130 names and 36 postal addresses.¹ The headline figure from the paper's abstract, counting across all sources including benchmarks: 367 PII artifacts, 363 technical identifiers, and 182 credentials — 912 distinct items total.¹

The finding that distinguishes this from routine input-hygiene concerns: 64 of those 704 artifacts appeared exclusively in the reasoning blocks and were absent from the parsed visible trace.¹ The paper's own statement: "Cross-user compatibility of encrypted reasoning renders plaintext-only sanitization ineffective, e.g., even if every user had removed all sensitive information from the visible trace, 62 API keys identified in our analysis would still have remained exposed in the reasoning blocks."¹

Even a user who had scrubbed every sensitive item from the visible session would not have removed those 64 exclusive artifacts — because those artifacts were never in the visible session.

Why input hygiene is not the full answer

The discipline covered in "Secrets Do Not Belong in Notes an AI Reads" — scoping the context, keeping credentials out of the folder the agent sees — addresses the input side of the pipeline.⁵ It is necessary. The corpus finding is that it is not sufficient, because some artifacts appear in the output the model produced, not in the input the user provided.

The authors make the un-sanitizable point explicitly: "even if users know that sensitive information hides in their reasoning blocks, aside from deleting, it remains impossible for users to sanitize and safely share them, as they have no means for decryption."¹

There is a related dimension covered in "The Vendor Cached Your Note and Someone Else Can Tell": the prompt cache is a vendor-held artifact with its own lifetime and an observable timing side-channel.⁹ The thinking block is the opposite — an artifact your client wrote to your own disk. The remedy for the prompt cache is a vendor setting. The remedy for the thinking block is a decision about how you handle the file.

The paper's scope note matters here: "our preliminary scan of traces in the wild is not an exhaustive audit … should only be seen as a targeted demonstration … we assume private datasets to be more affected by such privacy violations, as local agent transcripts and services are more likely to deal with sensitive information compared to publicly released traces."¹ The corpus was public GitHub and Hugging Face trajectories — the kind of data people considered safe to publish. Private local sessions were not measured. The authors assume they would show higher rates.

The caveats — read these before forwarding the finding

The base rates in the paper are low. Out of 315,320 decoded thinking blocks, 0.3% — 1,028 blocks — contained at least one privacy artifact.¹ Out of 6,708 sessions, 4.9% — 328 sessions — leaked at least one real sensitive item across their reasoning blocks.¹ The sample was public-domain trajectories, not private local sessions, and the authors are explicit about scope: "our empirical evaluation is restricted to the specific API versions and reasoning models available from Anthropic, OpenAI, and Google as of our testing period (early July 2026)."¹

The attacks described in the paper are not live as of the time this post was written. The authors state: "All model providers acknowledged the receipt of our report and subsequently we were unable to launch the same attacks."¹ The paper is a historical measurement, not an active threat disclosure. The finding that matters for this post is not the attack — it is the artifact class: what the block is, where it lives, and what the corpus found inside real blocks before the mitigation.

The authors' own de-escalation: "Although only approximately 9% of the artifacts were exclusive to reasoning, this fraction is not the central concern."¹ The central concern they identify is the un-sanitizable nature of the blocks — not that most artifacts are hidden there, but that the ones that are cannot be removed without deleting the file.

Green's direct-inspection result also belongs here: the blocks resisted simple reading or modification. The portability that made replay possible required a functioning provider endpoint willing to decrypt the signature. Opening the JSONL in a text editor shows an opaque blob, not plaintext.

What to do with the file on your disk

The session files your AI client writes are content, not exhaust. The same discipline that applies to any file holding your material applies here — and the first step is knowing what you have.

The per-vendor file locations are mapped in "Recover Your Work from the AI Tool's Session Files."⁴ Once you have found them:

Decide what leaves the machine. The thinking block's portability is a structural property — a signed block can be replayed across sessions, users, and models. Before sharing or syncing a session file, that portability is a fact about what you are sharing.

Apply the same retention discipline you apply to other logs. A session file is a log. Logs that contain credentials, drafts, or private correspondence have a retention window. The reasoning block extends that window beyond the visible text.

Do not assume input-side hygiene is sufficient. The 64 exclusive artifacts in the corpus appeared in the reasoning output, not in the user's input. Keeping secrets out of your context folder is the right start — it is not the complete answer.

Treat deletion as the sanitization path. The paper's finding is that the block cannot be decrypted and scrubbed by the user. If a session file contains sensitive reasoning you do not want to retain, deletion is the available option. There is no user-side decrypt-and-edit path.

The thinking block is not readable by opening the JSONL in a text editor, and the cryptography appears to have protected it against the specific replay attack after disclosure. But the file exists, the signature travels with it, and the corpus demonstrated that reasoning blocks can hold things the visible session never mentioned. Knowing that changes how you think about where the file goes.

Frequently Asked Questions

What is a thinking block in an AI session file?

A thinking block is a structured object in your AI client's session transcript that holds the model's chain-of-thought reasoning as an encrypted signature field, alongside whatever portion of the visible thinking text the model returned. The signature is required for multi-turn continuity: the client passes it back to the server on every subsequent request. All three major reasoning model providers — Anthropic, Google, and OpenAI — use this architecture.

Can I read the contents of the signature field myself?

No. The signature field is encrypted by the provider and the vendor documentation explicitly advises against interpreting or parsing it. Matthew Green's direct attempt found the fields resistant: "the cryptography mostly seems to protect them. Although we can look at the blocks, none of the fields they contain seem readable or malleable. Believe me, I tried."² The 2026 corpus paper's extraction technique required replaying the block into a live provider endpoint — it did not involve cracking the encryption directly.

Is the attack described in the paper still active?

No. The preprint states: "All model providers acknowledged the receipt of our report and subsequently we were unable to launch the same attacks."¹ The research is a historical measurement from a corpus of public trajectories collected through early July 2026. It documents what was possible before disclosure and mitigation — not an ongoing threat.

Does perfect input hygiene protect me from thinking-block artifacts?

Not completely. The corpus found 64 of 704 recovered privacy artifacts appeared exclusively inside reasoning blocks — absent from the visible session. If the model's reasoning surfaced or generated sensitive content that never appeared in the visible output, input-side discipline does not cover it. Both practices belong together: keep sensitive material out of the input context, and apply deliberate retention discipline to the session file itself.

What should I do with old session files that contain thinking blocks?

The paper identifies deletion as the only reliable sanitization path: users "have no means for decryption" and therefore cannot scrub the reasoning blocks without removing the file.¹ Decide which sessions you want to retain, apply the same retention window you would apply to any log containing private material, and delete sessions you no longer need. Per-vendor file locations are in an earlier post in this corpus.⁴

Do all AI models produce thinking blocks?

No. Thinking blocks are produced by reasoning models — models that expose extended chain-of-thought reasoning as a discrete API object. Claude's extended thinking models, Google's Gemini thinking models, and OpenAI's o-series reasoning models all return encrypted blocks in this form. Standard (non-reasoning) models do not produce the signature field.

How much data is actually in a typical signature field?

On the test machine used for this post, the median signature was 1,104 characters; the maximum was 62,920 characters.³ Across 18,280 thinking blocks, the signature fields total 41,249,028 characters — roughly 71.8 times the volume of the visible thinking text in the same files.³ The default omitted-thinking mode means the visible thinking field is empty in 95.6% of blocks, while the signature field is still present and populated.

Does this apply to both cloud-based and local AI tools?

The architecture is an API-level behavior: the encrypted block is produced by the model provider and returned to any client making API calls, regardless of where that client runs. A local AI tool that calls Anthropic, Google, or OpenAI will receive and store the same signature fields. The difference is where the file lands — local tools write it to your own disk, which gives you control over retention and sharing that a purely cloud-based session would not.

The opacity of a block is not the same as the privacy of its contents. The thinking block your client saved is signed, replayable, and structurally portable — properties the providers documented and measured researchers confirmed. What lived inside the blocks in a corpus of public trajectories included things that never appeared in any visible session. The reasonable response is not alarm. The attacks are mitigated and the base rates were low. The reasonable response is the same one that applies to every other file holding your work: know what it contains, decide deliberately what leaves the machine, and treat the session log as content rather than exhaust.

MNMNOTE stores your notes locally on your device — open Markdown files, no account required. mnmnote.com