A newly disclosed weakness in the way OpenAI, Anthropic, and Google carry hidden AI reasoning between API calls allowed researchers to recover internal reasoning and sensitive secrets from session logs, including API keys and passwords.

The weakness affected encrypted reasoning objects used by the providers' reasoning APIs. Researchers found that a reasoning block created in one session could be replayed into another and, during testing, even provided to a weaker model from the same provider family to reveal hidden content.

The research paper, Stealing Reasoning Traces from Proprietary LLM APIs, demonstrated four potential abuse paths:

  • Stealing proprietary reasoning for model distillation
  • Extracting private data from other users' published traces
  • Recovering harmful content hidden behind an otherwise safe response
  • Embedding prompt injections inside opaque reasoning blocks

Across 6,708 public agent trajectories, researchers decoded approximately 315,320 reasoning blocks. After excluding benchmark sources, they identified 704 privacy artifacts from genuine user sessions, including:

  • 62 API keys
  • 33 passwords
  • 24 access tokens
  • 7 private keys

Cross-Session Reasoning Replay

The attack did not involve breaking the underlying encryption or obtaining encryption keys.

Instead, researchers relied on the fact that intact encrypted reasoning objects were accepted and processed by compatible models.

The attack required obtaining an encrypted reasoning block, such as one exposed in a publicly available agent log, along with API access to a compatible model from the same provider.

During testing, researchers used weaker models as what they described as a "fuzzy" decoder:

  • Claude Haiku 4.5 for Claude reasoning traces
  • GPT-5.6 Luna for GPT reasoning traces
  • Gemini Robotics ER-1.6 for Gemini reasoning traces

The weaker model was prompted to reconstruct reasoning produced by a more capable model.

Sensitive Data Hidden Inside Reasoning

The most significant concern emerged when researchers examined published agent trajectories.

Of the 704 non-benchmark privacy artifacts, 64 appeared only inside hidden reasoning and nowhere in the visible trace.

This means sanitizing the visible conversation is not necessarily sufficient if encrypted reasoning objects are also published.

An attacker who obtains one of these opaque blocks could potentially replay it through a compatible API and attempt to recover information that the original developer believed was hidden.

The researchers emphasize that the attack does not provide arbitrary access to private conversations. The exposed data came from reasoning blocks that had already been published or otherwise obtained by the attacker.

Invisible Prompt Injection

The same portability issue also enabled a prompt-injection proof of concept.

Researchers created an opaque reasoning block containing a malicious instruction and later replayed it into an unrelated task.

The receiving model followed the hidden instruction and added an attacker-directed upload action, despite the malicious instruction never appearing in the visible conversation.

This creates a potentially dangerous boundary problem: security systems inspecting only visible prompts and responses may not see instructions embedded inside opaque reasoning objects.

How the Providers Store Reasoning

The problem originates from a design intended to preserve reasoning state across API calls when applications manage conversation history manually or operate in stateless environments.

OpenAI can return encrypted reasoning items that applications replay when manually managing history.

Anthropic carries reasoning in encrypted signatures associated with thinking blocks.

Google uses encrypted thought signatures to preserve reasoning state.

The encryption itself was not broken.

Instead, the researchers found that the providers' systems accepted encrypted reasoning objects outside the context in which they were originally generated.

Impact on Developers

The researchers disclosed their findings to the affected model providers, Microsoft, and Hugging Face.

They report that the demonstrated attacks stopped working after mitigations were introduced, and their reproducibility statement says the primary extraction attack was no longer reproducible as of August 2026.

However, the researchers note that the public record does not establish whether previously published reasoning blocks remain recoverable.

The study also does not report malicious exploitation of the techniques in the wild.

Recommendations

Developers using reasoning-capable AI APIs should treat encrypted reasoning objects as sensitive data, even when the contents are not directly readable.

Recommended defensive measures include:

  • Do not publish raw reasoning objects or opaque reasoning fields in public agent logs.
  • Strip encrypted reasoning blocks before sharing evaluation traces.
  • Avoid committing raw API transcripts to public repositories.
  • Treat sanitized visible conversations as potentially incomplete if hidden reasoning objects remain attached.
  • Review previously published agent trajectories for exposed reasoning blocks.
  • Minimize the retention and distribution of provider-generated reasoning artifacts.
  • Ensure cross-session and cross-model reasoning objects are handled according to the provider's latest security guidance.

Current provider documentation indicates that encrypted reasoning remains part of these APIs, although handling differs between providers. OpenAI continues to document replaying encrypted reasoning items when applications manually manage stateless history, while Google states that its backend manages thought compatibility when sessions switch models. Anthropic now states that thinking blocks are tied to the model that produced them and should be stripped when switching models because other models ignore them.

Earlier Research

The findings build on research published in May by Johns Hopkins cryptographer Matthew Green, who demonstrated that encrypted reasoning blocks could be replayed across sessions and accounts but did not demonstrate a reliable secret-extraction technique.

Green reported the replay behavior to OpenAI and Anthropic through their bug-bounty programs. According to his account, OpenAI considered the report unreproducible, while Anthropic said it did not identify security implications in the replay or associated side-channel behavior.

The new research expands on that behavior by demonstrating a broader extraction technique and documenting the potential privacy consequences at scale.

Bottom Line

The research does not demonstrate a break of the cryptography protecting proprietary AI reasoning.

Instead, it exposes a potentially dangerous assumption around where encrypted reasoning objects can be used and who can replay them.

For developers, the practical lesson is straightforward: encrypted does not necessarily mean safe to publish.

Reasoning traces, encrypted thinking blocks, and other opaque AI API artifacts should be treated as sensitive credentials or application data and removed from publicly accessible logs unless their security implications are fully understood.