Encrypted reasoning blobs are leaking API keys, emails, and internal addresses at scale

Ilia Shumailov, a researcher working on machine learning security, put a number on a problem that most of the industry has not begun to reckon with. Around 350,000 reasoning blobs, the encrypted trace outputs that large language models generate when working through a problem step by step, are sitting in public repositories online. When Shumailov and his colleagues ran a classifier over those blobs to detect privacy-sensitive content, they found results that warrant attention.

External reporting has since corroborated both the scale and the findings. Analysis documented at ccleaks.com describes researchers decoding roughly 315,320 encrypted reasoning blobs harvested from public code repositories, turning up 367 artifacts containing personally identifiable information and 182 containing credentials. Those figures track closely with Shumailov’s account: a large corpus of reasoning outputs, publicly accessible, carrying material that was almost certainly never intended to leave the systems that generated it.

The specific categories of sensitive data matter. API keys, email addresses, and internal Internet Protocol addresses were among the types of information the classifier surfaced. Each of those categories carries a different downstream risk. An exposed API key can be used to authenticate against a service until it is rotated. An email address, especially one associated with an internal system, expands an attacker’s surface for phishing or credential stuffing. An internal IP address reveals network topology that organizations routinely treat as confidential. None of these are theoretical concerns; they are the raw material of standard intrusion workflows.

I think around 350,000 reasoning blobs and then we just like ran a classifier on those whether they have some privacy related information and we found a bunch Ilia Shumailov

What makes this exposure unusual is the mechanism. Reasoning blobs are not source code, configuration files, or plaintext logs. Developers who have learned to scan for secrets in those conventional artifact types have no established habit of treating reasoning traces as a privacy surface. The blobs are encrypted, which creates a false impression of opacity. But encryption that can be reversed, or that was applied without adequate key management, offers no meaningful protection once the underlying data is recoverable, as the external analysis demonstrates.

The scale compounds the problem. At 350,000 publicly available blobs, this is not a handful of accidental commits that a diligent repository owner might notice and retract. It is a corpus large enough that manual remediation is not a realistic response. Organizations that have deployed reasoning-capable models in any workflow touching credentials, internal infrastructure documentation, or user data need to treat their reasoning outputs as potential leak vectors, the same way they treat log files or build artifacts.

Shumailov’s framing is understated, which is part of what makes it worth taking seriously. The claim is not that a catastrophic breach has already occurred. It is that the material is there, that a classifier can find the sensitive portions, and that “a bunch” of it contains privacy-relevant data. The corroborating analysis fills in the specifics: hundreds of credential artifacts and personally identifiable information artifacts, recovered from a corpus that grows every time a developer pushes a project to a public repository without considering what the model’s reasoning trace contains.

The broader implication is a tooling and awareness gap. Static analysis tools, secret scanning integrations, and pre-commit hooks have matured to the point where many engineering teams catch hardcoded credentials before they reach a remote repository. No equivalent infrastructure exists for reasoning blob outputs. Until it does, the corpus Shumailov describes will keep growing, and the classifier his team ran will keep finding things inside it.