Researchers have uncovered a significant design flaw in how leading AI model providers, including **OpenAI**, **Anthropic**, and **Google**, handle hidden AI reasoning between API calls. This vulnerability allowed them to recover internal reasoning traces and sensitive information like API keys and passwords from session logs. ### The Nature of the Flaw The weakness resided in the encrypted reasoning objects used by these providers' reasoning APIs. A block created in one session could be replayed into another, and crucially, even handed to a weaker model within the same provider's family to compel it to reveal the hidden content. The paper detailing these findings is titled "Stealing Reasoning Traces from Proprietary LLM APIs." ### Demonstrated Attack Paths The research team demonstrated four primary abuse paths: * **Stealing Proprietary Reasoning:** Extracting proprietary reasoning for model distillation. * **Extracting Private Data:** Recovering private data from other users' published traces. * **Revealing Harmful Content:** Uncovering malicious content concealed behind seemingly safe visible answers. * **Hiding Prompt Injections:** Embedding prompt injections within opaque reasoning blocks. ### Scale of Exposure Out of 6,708 public agent trajectories analyzed, the team successfully decoded 315,320 thinking blocks. Excluding benchmark sources, they identified 704 distinct privacy artifacts from genuine user sessions. This haul included 62 API keys, 33 passwords, 24 access tokens, and seven private keys. It's important to note that this cross-user attack did not grant arbitrary access to private chats. It required obtaining an encrypted reasoning block, such as one published in an agent log, and API access to a compatible model from the same provider. ### Vendor Response and Mitigations The researchers disclosed their findings to the affected model providers, including **Microsoft** and **Hugging Face**, who also manage AI services. They report that the demonstrated attacks ceased to be reproducible after mitigations were implemented, with the main extraction attack no longer working as of August 2026. However, there has been no public acknowledgment of the flaw from **OpenAI**, **Anthropic**, or **Google**, nor have they explicitly linked their updated documentation to this research. This leaves open questions regarding the decodability of already-published blocks containing sensitive data. ### How Reasoning Blocks Work The issue stems from a design choice meant to preserve reasoning across API calls, particularly when conversation state is managed manually or statelessly. * **OpenAI** returns encrypted reasoning items for applications to replay with manually managed history. * **Anthropic** carries full reasoning in an encrypted signature. * **Google** utilizes encrypted thought signatures. These objects are designed to preserve reasoning state without directly exposing the plaintext to the client.  ### The 'Fuzzy' Decoder Attack The attack did not involve cracking the encryption itself. Instead, it relied on the providers' systems accepting and processing these intact opaque blocks. During testing, these objects proved portable across sessions, users, and even different models. This allowed a weaker, compatible model to act as what the authors termed a "fuzzy" decoder. For example, **Claude Haiku 4.5** could decode traces from stronger Claude models, **GPT-5.6 Luna** for **GPT** traces, and **Gemini Robotics ER-1.6** for **Gemini** traces. The decoder model was prompted to transcribe reasoning produced by its more powerful counterpart. This cross-user portability turns publicly published agent logs into a significant security concern. Of the 704 non-benchmark artifacts recovered, 64 were found exclusively within hidden reasoning blocks and not in the visible trace. This means that merely sanitizing the readable conversation would leave sensitive data exposed within an opaque block, replayable by another account. ### Invisible Prompt Injections The same portability also facilitated an invisible prompt-injection proof of concept. The team crafted an opaque reasoning block containing a malicious instruction. When replayed into an unrelated task, this caused the receiving model to execute an attacker-directed action, such as an upload, without the injected instruction ever appearing in visible text. ### Developer Guidance While no malicious exploitation in the wild has been documented, developers are strongly advised to strip reasoning blocks and opaque reasoning fields from shared traces. It is also critical to avoid committing raw API transcripts, even if the visible text has been sanitized. ### Evolution of Vendor Documentation Current vendor documentation shows that encrypted reasoning remains part of these APIs, but handling has evolved: * **OpenAI** still instructs developers to replay encrypted reasoning items for manual stateless history management. * **Google** states its backend manages thought compatibility when a session switches models. * **Anthropic** now advises that thinking blocks are tied to their originating model and should be stripped when switching models, as other models will ignore them. ### Building on Prior Research This work expands upon May research by **Johns Hopkins** cryptographer **Matthew Green**, who demonstrated that encrypted reasoning blocks could be replayed across sessions and accounts but did not achieve a reliable secret-extraction technique. Green reported the replay behavior to **OpenAI** and **Anthropic** through their bug bounty programs. **OpenAI** deemed his report unreproducible, and **Anthropic** stated it did not perceive security implications in the replay or side-channel behavior. The new paper, however, transforms that replay behavior into a broader extraction method, underscoring significant privacy consequences at scale.