AI Reasoning APIs Flawed, Exposing Secrets and Enabling Model Distillation
A newly disclosed flaw in OpenAI, Anthropic, and Google's AI reasoning APIs allowed researchers to extract sensitive data like API keys and passwords from session logs.
A significant vulnerability has been uncovered in the reasoning APIs of major AI providers OpenAI, Anthropic, and Google. Researchers demonstrated that a flaw in how these platforms handle encrypted reasoning objects allowed them to recover sensitive data, including API keys and passwords, directly from session logs. This weakness exploited the replayability of these objects, enabling attacks that could expose proprietary AI model logic and user credentials.
The research, detailed in the paper "Stealing Reasoning Traces from Proprietary LLM APIs," identified four primary abuse paths. These included stealing proprietary reasoning for model distillation, extracting private data from other users' published traces, recovering harmful content concealed behind safe visible answers, and hiding prompt injections within opaque reasoning blocks. The team analyzed over 6,700 public agent trajectories, decoding more than 315,000 thinking blocks and identifying 704 distinct privacy artifacts from genuine user sessions, such as API keys, passwords, and private keys.
The cross-user attack required obtaining an encrypted reasoning block from a published agent log and having API access to a compatible model from the same provider. It did not grant arbitrary access to private chats but leveraged the portability of these reasoning objects. The researchers disclosed their findings to the affected providers, and mitigations have reportedly stopped the main extraction attack from being reproducible as of August 2026. However, the report does not document any malicious exploitation in the wild.
The vulnerability stemmed from a design intended to preserve AI reasoning across API calls, particularly in stateless or manually managed conversation states. OpenAI, Anthropic, and Google all utilize encrypted reasoning items or thought signatures to maintain session context without directly exposing plaintext to clients. The encryption itself was not compromised; the attack relied on the intact opaque blocks being accepted and processed by the provider's systems.
During testing, the researchers found these reasoning objects to be portable across sessions, users, and even different models within the same provider family. A weaker model could act as a "fuzzy" decoder, prompted to transcribe reasoning produced by a stronger model. For instance, Claude Haiku 4.5 could decode Claude traces, GPT-5.6 Luna could decode GPT traces, and Gemini Robotics ER-1.6 could decode Gemini traces. This cross-user portability turned publicly shared agent logs into a significant security concern.
This portability also enabled a proof-of-concept for invisible prompt injection. The researchers crafted an opaque reasoning block containing a malicious instruction, which was later replayed into an unrelated task. This caused the receiving model to execute an attacker-directed upload action without the injected instruction being visible in the standard conversation trace. While the authors cannot guarantee exact plaintext reconstruction due to the proprietary nature of the reasoning, their fidelity checks, based on token counts and qualitative comparisons, indicated high accuracy.
While current vendor documentation indicates that encrypted reasoning remains a feature, handling practices have evolved. Anthropic now states that thinking blocks are model-specific and should be stripped when switching models. OpenAI and Google have also updated their guidance on managing session state and model compatibility. Although the researchers claim the demonstrated attacks are no longer reproducible, there has been no public acknowledgment from the providers, and it remains unclear whether previously published, potentially vulnerable reasoning blocks are still decodable.