API Flaw Let Researchers Pull Hidden Reasoning and Secrets From AI Session Logs

A newly reported weakness in how OpenAI, Anthropic, and Google handle hidden AI reasoning between API calls allowed researchers to recover internal reasoning and sensitive data from session logs, including API keys and passwords.

The issue affected encrypted reasoning objects used by the providers' reasoning APIs. During testing, a block created in one session could be replayed into another and even handed to a weaker model from the same provider family to reveal the hidden content. The team behind the paper "Stealing Reasoning Traces from Proprietary LLM APIs" demonstrated four abuse paths: stealing proprietary reasoning for model distillation, extracting private data from other users' published traces, recovering harmful content hidden behind a safe visible answer, and hiding prompt injections inside opaque reasoning blocks.

Across 6,708 public agent trajectories, the team decoded 315,320 thinking blocks. After excluding benchmark sources, they counted 704 distinct privacy artifacts from genuine user sessions, including 62 API keys, 33 passwords, 24 access tokens, and seven private keys. The cross-user attack required obtaining an encrypted reasoning block, such as one published in an agent log, and API access to a compatible model from the same provider.

The researchers disclosed the findings to the affected providers, Microsoft, and Hugging Face, and say the demonstrated attacks stopped working after mitigations. Their reproducibility statement says the main extraction attack is no longer reproducible as of August 2026. The report does not document malicious exploitation in the wild. Developers are advised to strip reasoning blocks from shared traces and avoid committing raw API transcripts even when visible text has been sanitized.

The problem stems from a design meant to preserve reasoning across API calls when conversation state is managed manually or statelessly. OpenAI can return encrypted reasoning items that applications replay with manually managed history, Anthropic carries full reasoning in an encrypted signature, and Google uses encrypted thought signatures. The encryption itself was not cracked, and the attack did not require obtaining an encryption key. It relied on intact opaque blocks being accepted and processed by the provider.

During testing, the paper found those objects portable across sessions, users, and models, allowing a weaker compatible model to act as a "fuzzy" decoder: Claude Haiku 4.5 for Claude traces, GPT-5.6 Luna for GPT traces, and Gemini Robotics ER-1.6 for Gemini traces. The decoder was prompted to transcribe reasoning produced by a stronger model.

Of the 704 non-benchmark artifacts recovered, 64 appeared only in hidden reasoning and nowhere in the visible trace. Sanitizing the readable conversation could therefore leave secrets inside an opaque block that another account was able to replay. The exposure lands on developers who published raw agent logs with the reasoning objects intact.

The same portability enabled an invisible prompt-injection proof of concept. The team crafted an opaque reasoning block carrying a malicious instruction and replayed it into an unrelated task, causing the receiving model to add an attacker-directed upload action without putting the injected instruction in visible text.

The authors caution they do not have ground-truth plaintext for the proprietary reasoning, so they cannot guarantee every reconstructed trace is an exact copy. Their fidelity checks relied on reasoning-token counts and qualitative comparisons.

Current vendor documentation shows encrypted reasoning remains part of these APIs, but handling has changed. OpenAI still tells developers to replay encrypted reasoning items when manually managing stateless history, while Google says its backend manages thought compatibility when a session switches models. Anthropic now says thinking blocks are tied to the model that produced them and should be stripped when switching models because other models ignore them.

No public acknowledgment of the flaw from any of the three providers has surfaced so far, and none has tied its current documentation to this research. The account that the demonstrated attacks no longer work rests on the researchers' own reproducibility statement rather than on vendor confirmation. The record also does not address whether already-published blocks remain decodable.

The work builds on May research by Johns Hopkins cryptographer Matthew Green, who showed encrypted reasoning blocks could be replayed across sessions and accounts but stopped short of reliable secret extraction. Green says he reported the replay behavior to OpenAI and Anthropic through bug-bounty programs; in his account, OpenAI called the report unreproducible and Anthropic said it did not see security implications. The new paper turns that replay behavior into a broader extraction method and documents privacy consequences at scale.

Source: The Hackers News