OpenAI, Anthropic, Google seal AI sessions behind encrypted state
An essay from tool-builder earendil.com, posted to Hacker News and drawing 333 points and 77 comments, argues that the original promise of inference APIs, that a saved transcript of inputs and outputs fully represented a conversation and could be handed to any model, is being quietly broken by the major labs. The piece catalogs six features that now return provider-bound state instead of plain text: encrypted reasoning tokens the user is billed for but cannot read, server-side web search where the model sees source material the client never gets, opaque server-side compaction of long context, encrypted instructions and messages between subagents, and file, vector-store, container and cache references and conversation IDs that only resolve on the original provider's servers.
The author proposes a concrete test for whether a session is truly portable: export the transcript, revoke credentials with the old provider, and hand the export to a new provider to continue the work. That splits into five checks: can the user inspect what the model saw and what tools did (Inspection); is the session self-contained (Export); can another implementation reconstruct an equivalent context (Replay); can a human explain after the fact why the system acted (Audit); and can the user find and delete every server-side copy the session depends on (Deletion).
Specifics cited include OpenAI's Responses API, which stores response objects by default for at least 30 days (store: false avoids that, but then returns reasoning as an opaque encrypted_content blob instead); Google's new Gemini Interactions API, which defaults to store: true and retains interactions for 55 days on the paid tier and one day on the free tier; and Anthropic, whose API returns full chain-of-thought sealed in a signature field, with documentation stating that thinking blocks are tied to the model that produced them and should be stripped when switching models. On compaction, OpenAI's server-side feature emits what its own documentation calls an encrypted item "opaque and not intended to be human-interpretable," while Anthropic's server-side compaction instead returns a readable content field the client can customize and pass to another model. The essay also flags OpenAI's hosted multi-agent beta, which seals messages between subagents as encrypted_content, auto-enables server-side compaction for every agent even without a request, and injects root and subagent instructions the developer cannot edit or remove; it notes a June 2026 commit in the open-source Codex client, titled "Encrypt multi-agent v2 message payloads," that applies the same sealing pattern there.
The author's stated conclusion is that some of this genuinely serves privacy, for instance letting OpenAI decrypt reasoning only in memory for zero-data-retention customers without persisting it server-side, but that none of it required encryption from the user's own point of view: the content is hidden from the client, not from the provider, and the practical effect is to raise the cost of moving a session to a competing model.
Key facts
- OpenAI's Responses API stores response objects by default for at least 30 days; store: false avoids that but returns reasoning tokens only as opaque encrypted_content blobs.
- Google's new Gemini Interactions API defaults to store: true, retaining interactions 55 days on the paid tier and just one day on the free tier.
- Anthropic seals full chain-of-thought in a signature field and its own docs say thinking blocks should be stripped when switching models, so the reasoning never travels to another provider.
- OpenAI's server-side compaction produces an item its docs call "opaque and not intended to be human-interpretable," while Anthropic's compaction returns a readable, client-customizable summary instead.
- OpenAI's hosted multi-agent beta encrypts inter-agent messages and auto-enables compaction for every agent; a June 2026 Codex commit, "Encrypt multi-agent v2 message payloads," extends the same sealing to the open-source client.
Why it matters
The essay reframes a set of scattered API design choices, encrypted reasoning, hosted search, server-side compaction, sealed multi-agent messaging, as one pattern: the transcript that used to fully belong to the user is turning into a partial view of a session whose real operational state lives on the provider's servers. That is a quiet but consequential shift in who owns an AI conversation, and it lands squarely as vendor lock-in dressed as a technical necessity.
Who it affects
Anyone building on top of OpenAI's, Anthropic's or Google's inference APIs: developers wiring up agents and multi-agent systems, teams evaluating whether they can switch model providers without losing context, and enterprises weighing Zero Data Retention terms. It also affects end users of AI products, whose sessions become harder to export, audit or delete in full even though they are the ones billed for the tokens involved.
How to use it
The author's five-part test doubles as a due-diligence checklist for picking a provider or API mode: can you inspect what the model and its tools actually saw (Inspection), is the exported session self-contained (Export), can a different provider's model pick up the same context (Replay), can you explain after the fact why the system acted (Audit), and can you locate and delete every server-side copy (Deletion). Practically, that means preferring store: false where privacy allows, checking whether hosted search exposes full retrieved passages rather than just citations, and favoring compaction that returns a readable summary over one that is contractually opaque.
How solid is it
The claims rest on public API documentation and behavior from OpenAI, Google and Anthropic, plus a dated, named commit in the open-source Codex client, rather than on a leak or speculation, which makes the specific facts (retention windows, field names, documented restrictions) checkable. It is nonetheless an opinion essay from a company that builds tools in this space and says so explicitly; the framing and the choice of which features to highlight reflect that stance, even where the underlying documentation citations are accurate.
Risks and caveats
The piece itself concedes that some of this encryption serves a real privacy purpose, for instance letting OpenAI decrypt reasoning only in memory for Zero Data Retention customers without persistent server-side storage, so the pattern is not uniformly bad-faith. Readers should also note the HN discussion (333 points, 77 comments) reflects developer sentiment on one platform, not a broader survey, and provider APIs and retention terms in this space change quickly enough that specific numbers cited here may shift.
“This encryption does not hide the data from the inference provider but it hides it from you.”
— earendil.com, "The Session You Cannot Take With You"