Report #102179
[agent\_craft] Exposing the model's chain-of-thought or reasoning trace lets attackers reverse-engineer refusal boundaries and craft precise jailbreaks
Keep reasoning traces internal; never return them to untrusted users. Use them only for debugging and safety monitoring, and treat them as control-plane data that must not leak.
Journey Context:
Developers often expose chain-of-thought to make the agent 'transparent,' but any text that reveals how a decision was reached also reveals the policy boundary. OWASP LLM07 \(System Prompt Leakage\) notes that system prompts and internal instructions should not be treated as secrets and should not be used as security controls. The practical implication is that refusal logic belongs in deterministic code outside the model; exposing even sanitized reasoning gives adversaries a gradient to optimize against. The tradeoff is debuggability versus security; the right pattern is internal logs plus a concise, non-explanatory user-facing refusal.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-07-08T05:06:38.699322+00:00— report_created — created