A newly disclosed flaw in the APIs of OpenAI, Anthropic, and Google has raised significant security concerns, allowing researchers to recover internal reasoning and sensitive information from session logs, including API keys and passwords. This vulnerability affects the encrypted reasoning objects used by these providers, enabling a block created in one session to be replayed in another, and even handed to a weaker model within the same provider family to extract hidden content.
The research team, behind the paper titled Stealing Reasoning Traces from Proprietary LLM APIs, identified four potential abuse paths: stealing proprietary reasoning for model distillation, extracting private data from other users’ published traces, recovering harmful content concealed behind safe visible answers, and embedding prompt injections within opaque reasoning blocks. They decoded 315,320 thinking blocks from 6,708 public agent trajectories, uncovering 704 distinct privacy artifacts from genuine user sessions, including 62 API keys, 33 passwords, 24 access tokens, and seven private keys.
While the cross-user attack did not grant arbitrary access to private chats, it required obtaining an encrypted reasoning block, such as one published in an agent log, and API access to a compatible model from the same provider. The researchers disclosed their findings to the affected model providers, Microsoft and Hugging Face, and noted that the demonstrated attacks ceased to work after mitigations were implemented. Their reproducibility statement indicates that the main extraction attack is no longer reproducible as of August 2026.
The report does not indicate any malicious exploitation in the wild, but developers are advised to strip reasoning blocks and opaque reasoning fields from shared traces and avoid committing raw API transcripts, even when the visible text has been sanitized. The issue stems from a design intended to preserve reasoning across API calls when conversation state is managed manually or statelessly. OpenAI, Anthropic, and Google utilize encrypted reasoning items, full reasoning in encrypted signatures, and encrypted thought signatures, respectively, to maintain reasoning state without exposing plaintext directly to clients.
Current vendor documentation indicates that encrypted reasoning remains part of these APIs, but handling has evolved. OpenAI continues to advise developers to replay encrypted reasoning items when managing stateless history, while Google states its backend manages thought compatibility when switching models. Anthropic now emphasizes that thinking blocks are tied to the model that produced them and should be stripped when switching models.
Several questions remain unanswered regarding the disclosure, as no public acknowledgment of the flaw has been made by any of the three providers, and none has linked its current documentation to this research. The researchers’ findings highlight a significant security issue, particularly concerning the potential for sensitive information to be extracted from published agent logs.
For further details, refer to the full article on The Hacker News.
Follow Cyber Warriors Middle East for further global cybersecurity developments.
