LLM APIs Vulnerable to Reasoning Trace Exposure, Exposing Sensitive Data
A shared encryption key flaw in OpenAI, Anthropic, and Google LLM APIs allows attackers to replay encrypted reasoning traces into weaker models, exposing PII and credentials.
Researchers have uncovered a significant architectural vulnerability affecting the large language model (LLM) APIs of major providers including OpenAI, Anthropic, and Google. The flaw allows adversaries to extract sensitive, encrypted "chain-of-thought" reasoning traces generated by flagship models. These traces, which contain proprietary information and safety checks, are normally withheld from plain text. Instead, they are transmitted as encrypted, base64-encoded envelopes by the APIs. This mechanism is designed to maintain conversational context across multiple turns without requiring server-side state storage.
The core of the vulnerability lies in the authentication method for these encrypted payloads. Instead of being cryptographically bound to a specific user, session, or model tier, the reasoning envelopes are protected by a global, provider-wide encryption key. This means an encrypted block generated by a powerful, heavily guarded model can be legitimately passed to any other model hosted within the same provider's infrastructure, regardless of its security posture.
Attackers can exploit this by capturing an encrypted reasoning block from a frontier model, such as Claude Opus 4.8 or GPT-5.6. They then inject this captured block into an API call directed at a smaller, less-guarded sibling model, such as Claude Haiku 4.5 or GPT-5-mini. The prompt instructs the weaker model to transcribe the internal thinking verbatim. Because these lighter models often lack the stringent alignment and safety guardrails of their premium counterparts, they comply with the prompt and output the hidden reasoning in plain text.
The implications of this attack are far-reaching. The researchers demonstrated that this technique can be used for more than just intellectual property theft or model distillation. By analyzing public agent transcripts scraped from platforms like GitHub and Hugging Face, they decoded numerous reasoning blocks. This analysis revealed the exposure of 367 Personally Identifiable Information (PII) artifacts and 182 hardcoded credentials, including API keys, passwords, and personal email addresses. Crucially, much of this sensitive data was present only within the internal reasoning traces and was never visible in the assistant's final response, leaving developers unaware of the exposed secrets.
Furthermore, the vulnerability enables sophisticated indirect prompt injection attacks against autonomous AI agents. An adversary can embed malicious instructions within an encrypted reasoning block. When this block is processed by an AI agent, standard monitoring tools that only inspect the visible conversation history will fail to detect the hidden payload. This allows the injected instructions to compromise downstream agentic workflows without detection, potentially leading to unauthorized actions or data exfiltration.
The research team confirmed the cross-model compatibility and the accuracy of the recovered traces across OpenAI's GPT-5.6 family and Google's Gemini 3 lineup. The decoded token lengths precisely matched the billable thinking token counts reported by the provider APIs, validating the integrity of the extracted information.
Following responsible disclosure, OpenAI, Anthropic, and Google have acknowledged the findings and implemented server-side mitigations. These measures have rendered the original proof-of-concept attacks non-reproducible on current API builds. To bolster generative AI security, providers and enterprise developers are advised to implement cryptographic binding of reasoning envelopes to specific users and sessions, enforce strict model isolation, rotate legacy keys, and sanitize logs to scrub sensitive fields before public release.
This incident underscores the critical need for robust security controls in the rapidly evolving landscape of AI development. As LLMs become more integrated into critical business processes, vulnerabilities in their underlying infrastructure can have profound consequences, highlighting the ongoing challenge of securing complex AI systems.