Claude's Encrypted Reasoning Block: A Byte-Level Look Inside the Signature

A new article on Habr details how to extract hidden reasoning chains from closed models by exploiting a flaw: an attacker takes an encrypted block from a strong model, gives it to a weaker sibling model from the same provider, and asks for a verbatim retelling, thus reading the original thoughts, including any accidentally included passwords or keys. The author reveals that the 'signature' field attached to every Claude thinking block is not opaque: it is a protobuf that can be parsed without any keys. Inside, only the actual thinking text is encrypted (AES-GCM, with a 16-byte tag), while the outer envelope and header contain metadata in plaintext. The header includes the model ID (e.g., 'claude-opus-5'), block type, and, since version 15 (July 2026), the organization UUID from the user's ~/.claude.json. This metadata is covered by a MAC, so blocks cannot be tampered with, but if exposed in logs, it can link a user to their organization and model usage. The author suggests the vulnerability described in the preprint may be mitigated by the presence of this metadata, but the practical risk is that the unencrypted header leaks sensitive information when agent logs are shared.