A newly reported security weakness in the systems used by OpenAI, Anthropic and Google to preserve hidden AI reasoning between API calls has allowed researchers to reconstruct internal reasoning and uncover sensitive information, including API keys, passwords and access tokens.
The issue involves encrypted reasoning objects generated by the companies' reasoning APIs. Although these objects are designed to keep internal reasoning hidden from developers, researchers found that an object generated during one session could be replayed in another. In some tests, the same objects could also be supplied to a less capable model from the same provider, which could then help reconstruct the concealed content.
The findings are detailed in a paper titled Stealing Reasoning Traces from Proprietary LLM APIs. Researchers identified four potential attack scenarios: extracting proprietary reasoning that could be used for model distillation, recovering private information from publicly shared agent traces, reconstructing harmful material hidden behind seemingly safe responses, and embedding prompt injections inside encrypted reasoning objects.
Hundreds of thousands of reasoning blocks examined
Researchers analyzed 6,708 publicly available agent trajectories and successfully decoded 315,320 reasoning blocks. After removing benchmark-related material, they identified 704 separate privacy-related artifacts originating from genuine user sessions. These included 62 API keys, 33 passwords, 24 access tokens and seven private keys.
The researchers stressed that the cross-user technique did not amount to unrestricted access to private conversations. An attacker needed access to an encrypted reasoning block, such as one exposed through a publicly available agent log, as well as API access to a compatible model belonging to the same provider.
The researchers said they reported the findings to the affected AI companies, Microsoft and Hugging Face. According to the paper's reproducibility statement, the demonstrated attacks stopped functioning following mitigation efforts, with the primary extraction technique no longer reproducible as of August 2026.
There is no indication in the report that the technique has been exploited maliciously in the wild. However, developers are advised to remove reasoning blocks and other opaque reasoning fields before sharing agent traces and to avoid storing raw API transcripts, even when the visible portions have been sanitized.
Encryption was not broken
The vulnerability did not involve cracking the encryption protecting the reasoning data or obtaining an encryption key. Instead, the researchers exploited the fact that the encrypted objects remained valid and could be accepted by compatible systems.
The underlying design is intended to preserve reasoning state when developers manage conversation history manually or use stateless API workflows. OpenAI can provide encrypted reasoning items for applications that replay manually managed history, Anthropic uses encrypted signatures to carry reasoning, while Google's systems use encrypted thought signatures.
During their experiments, researchers found that these objects could be moved between sessions, accounts and, under certain circumstances, models. A less powerful compatible model could then be used as what the researchers describe as a "fuzzy" decoder to reconstruct reasoning generated by a more capable model.
The models tested as decoders included Claude Haiku 4.5 for Claude traces, GPT-5.6 Luna for GPT traces and Gemini Robotics ER-1.6 for Gemini traces. The researchers instructed the models to reproduce reasoning that had originally been generated by a stronger model.
Published agent logs created a privacy risk
The cross-user aspect of the research raises particular concerns for developers who publicly release raw agent logs containing encrypted reasoning objects.
Of the 704 non-benchmark privacy artifacts recovered by the researchers, 64 were found exclusively within hidden reasoning and did not appear anywhere in the visible portions of the corresponding traces. This means that simply removing secrets from readable conversations may not be sufficient if the original encrypted reasoning object remains available.
The researchers described the exposure as limited rather than universal. The demonstrated scenario primarily affected developers who had published raw agent traces containing intact reasoning objects, rather than automatically exposing every user of the affected APIs.
Encrypted reasoning could also carry hidden instructions
The portability of reasoning objects created another potential security concern. Researchers demonstrated a proof of concept in which an opaque reasoning block contained a malicious instruction that was subsequently replayed during an unrelated task.
Because the instruction was hidden inside the encrypted object rather than visible in the conversation, the receiving model could process the injected command without the malicious text
[…]
Content was trimmed to protect the source. Please visit the original article for the full text.
Read the original article: