Researchers have uncovered a flaw in how OpenAI, Anthropic, and Google handle encrypted reasoning blocks in their APIs, allowing them to recover internal reasoning and sensitive data like API keys and passwords from session logs.
The vulnerability affected the encrypted reasoning objects used by these providers' reasoning APIs. A block created in one session could be replayed into another, and during testing, even a weaker model from the same provider family could be tricked into revealing the hidden content.
The study, titled "Stealing Reasoning Traces from Proprietary LLM APIs," demonstrated four attack paths: stealing proprietary reasoning for model distillation, extracting private data from other users' published traces, recovering harmful content hidden behind safe visible answers, and hiding prompt injections inside opaque reasoning blocks.
Across 6,708 public agent trajectories, the team decoded 315,320 thinking blocks. Excluding benchmark sources, they found 704 distinct privacy artifacts from real user sessions, including 62 API keys, 33 passwords, 24 access tokens, and seven private keys.
The cross-user attack wasn't arbitrary. It required obtaining an encrypted reasoning block—such as one published in an agent log—and API access to a compatible model from the same provider.
The researchers reported their findings to the affected providers, Microsoft, and Hugging Face. They state the demonstrated attacks stopped working after mitigations, and the main extraction attack is no longer reproducible as of August 2026. However, the report doesn't document any malicious exploitation in the wild, and no public acknowledgment from the three providers has surfaced.
The issue stems from a design meant to preserve reasoning across API calls when conversation state is managed manually or statelessly. OpenAI returns encrypted reasoning items for replay, Anthropic carries full reasoning in an encrypted signature, and Google uses encrypted thought signatures. The encryption itself wasn't cracked, and the attack didn't require an encryption key—it relied on intact opaque blocks being accepted and processed.
During testing, the objects were portable across sessions, users, and models, allowing weaker models like Claude Haiku 4.5, GPT-5.6 Luna, and Gemini Robotics ER-1.6 to act as "fuzzy" decoders for their stronger counterparts. Of the 704 non-benchmark artifacts recovered, 64 appeared only in hidden reasoning, meaning sanitizing visible text could still leave secrets inside an opaque block.
The exposure is bounded: it affects developers who published raw agent logs with reasoning objects intact, not every API user. The same portability also enabled an invisible prompt-injection proof of concept, where a malicious instruction in an opaque block was replayed into an unrelated task, causing the model to take an attacker-directed action.
The authors caution they lack ground-truth plaintext for proprietary reasoning, so exact copies aren't guaranteed. Their fidelity checks relied on token counts and qualitative comparisons. Current vendor documentation shows encrypted reasoning remains part of these APIs, but handling has changed: OpenAI still advises replaying encrypted items for stateless history, Google manages thought compatibility backend-side, and Anthropic now says thinking blocks should be stripped when switching models.
The work builds on May research by cryptographer Matthew Green, who showed replay behavior across sessions and accounts but didn't achieve reliable secret extraction. Green reported the issue to OpenAI and Anthropic via bug bounty programs; OpenAI called it unreproducible, and Anthropic saw no security implications. The new paper expands that replay into a broader extraction method and documents the privacy consequences at scale. Developers are advised to strip reasoning blocks from shared traces and avoid committing raw API transcripts, even if visible text is sanitized.
Source: The Hackers News