You Paid for Those Tokens. You Still Can't Take Them With You.

Try it yourself. Call a reasoning model through its API, pull the thinking content out of the response, and hand it to a different vendor’s model. It won’t work. What you’re holding is usually an encrypted string that only the company that generated it can decrypt. Your account. Your bill. Their padlock.

One disclaimer up front: this isn’t a report on community sentiment. I went looking for the debate and mostly found silence — no serious Reddit threads on it in the past month, nothing on HN that treats it as a headline issue. So this is an argument built from what’s plainly visible in provider API docs today, and where that structure points once real money is on the line.

Why the Chain of Thought Got Sealed

Reasoning models — the class that took over after 2024 — think before they answer. They break the problem apart, float a hypothesis, back out when it fails. All of that comes out as tokens, and all of it gets billed. Standard stuff.

The interesting part comes next. In multi-turn conversations and tool-using agent loops, you have to feed the previous turn’s reasoning back in or the model loses its own thread. But providers don’t hand that reasoning back in plaintext. You get a signed or encrypted block. Your only legal move is to pass it back exactly as received, byte for byte.

The stated reasons are roughly three. Exposed chains of thought become training data for competitors. Editable chains of thought become a jailbreak vector — rewrite the model’s own reasoning, feed it back, and safety training gets a lot easier to route around. And raw reasoning is messy and unpolished in ways that mislead people who read it as a final answer. None of those are bogus.

Good Reasons, Awkward Consequences

A justified design decision can still have unjustified side effects. Encrypted reasoning blocks create what’s best described as provider-sealed state, and the cost shows up the moment you try to leave.

Picture an agent twenty tool calls into a complicated task. At step fifteen you want to switch models — something cheaper, faster, or just better at this particular sub-problem. What can you actually carry over? User messages, final outputs, tool call results. That’s it. Every scrap of internal judgment the model accumulated between those visible steps gets thrown away. The new model starts thinking from scratch.

So switching costs aren’t zero. They’re exactly equal to the reasoning you’ve accumulated so far. The longer and more valuable the session, the more expensive the exit. That’s a lock-in curve that steepens precisely where you’d most want the freedom.

Data Portability Law Was Written for Files

Portability debates have always been about static assets. Can I download my photos, my contacts, my documents, and upload them somewhere else? GDPR’s Article 20 right to data portability was drafted in that frame, and so were most of the US state privacy laws that followed.

AI session state doesn’t fit the frame. It’s not a file — it’s a computation in progress. Closer to a game save than a document, except the save only opens on one console. You can download it. You just can’t open it.

That gap is legally awkward in a way regulators haven’t caught up to. A provider can say, truthfully, that they returned your data — the block is right there in the response. From your side, you received something you cannot use. Formally portable, practically stuck. Nobody has tested whether “here’s your ciphertext” satisfies a portability obligation, and until someone does, the incentive is to keep shipping ciphertext.

What Teams Are Actually Doing About It

Workarounds have already hardened into patterns.

The most common is cutting at turn boundaries. Keep sessions short. At the end of each turn, compress the accumulated context into a human-readable summary and store it in your own database. When you need to switch models, restart from the summary. You lose reasoning granularity and keep portability.

Second is pulling state up into the application layer. Conversation history, tool results, intermediate artifacts — all structured in your own store, with each call assembling only what’s needed. You stop treating the model as a partner that holds state and start treating it as a stateless function. Costs more in tokens. Buys you the ability to walk.

Third is giving up on reasoning reuse entirely. Every call independent, every time. There’s a real performance hit, and some teams have decided that hit is cheaper than the lock-in risk.

All three say the same thing from different angles: portability costs you something, in latency or dollars or output quality. It is never free.

Is This Actually Bad Design?

I don’t want to pretend this is a villain story. The reasons for sealing are real. Jailbreak-by-reasoning-injection is a genuine attack surface, and competitors distilling frontier reasoning traces into their own models is not hypothetical — it’s happened, publicly, and it’s why the seals exist.

What makes this worth flagging is how invisible it is. A three-year minimum contract term is legible to anyone who reads it. An encrypted field in an API response is something you don’t feel until the day you try to switch — and by then your system is built on top of it. Lock-in you can see gets negotiated. Lock-in you can’t see gets accepted by default.

None of this is technically unsolvable, either. A standardized session state format. An opt-in flag that returns plaintext reasoning for customers who explicitly accept the tradeoff. Cross-provider decryption agreements, the way roaming works between carriers. All feasible. None urgent, because nobody on the selling side has a reason to hurry.

The Takeaway

The lock in AI infrastructure has migrated. It used to sit on data formats; now it sits on computation state. You can export the files. You cannot export the thought in progress.

If you’re wiring AI into a product right now, it’s worth spending an hour on one question: if we had to swap providers tomorrow, what exactly do we lose? If the answer is “not much,” you built it well. If you can’t answer cleanly, find out now — while the answer is still cheap.