A recent study has revealed a critical vulnerability in the APIs of major AI providers, including OpenAI, Anthropic, and Google, which enabled researchers to extract concealed reasoning and sensitive information from session logs. This flaw compromised encrypted reasoning objects, allowing weaker models to decode information from stronger counterparts.
Discovery of the API Flaw
The vulnerability was identified in the reasoning APIs used by these AI giants. Researchers discovered that encrypted reasoning blocks created during one session could be reused or replayed across different sessions. Remarkably, these blocks could be decoded by weaker models within the same provider’s ecosystem, revealing the hidden content.
The research paper titled “Stealing Reasoning Traces from Proprietary LLM APIs” outlined four potential exploitation paths: model distillation, extraction of private data, recovery of harmful content, and embedding prompt injections within opaque reasoning blocks.
Implications of the Vulnerability
During the study, the researchers managed to decode over 315,000 reasoning blocks from 6,708 public agent trajectories. This included identifying 704 distinct privacy artifacts from genuine user sessions, comprising API keys, passwords, and access tokens. While the cross-user attack didn’t allow unrestricted access to private chats, it did require an encrypted reasoning block and API access to a compatible model.
The findings were disclosed to the affected companies, including Microsoft and Hugging Face, resulting in mitigations that rendered the attacks non-reproducible by August 2026. However, the study did not find evidence of malicious exploitation in the wild.
Recommendations and Future Outlook
Developers are advised to remove reasoning blocks and opaque fields from shared traces and avoid sharing raw API transcripts, even if sanitized. The issue arises from a design intended to maintain reasoning across API calls, without exposing underlying plaintext.
Although the encryption was not compromised, the flaw allowed intact opaque blocks to be processed by providers, enabling cross-session and cross-model portability. The researchers emphasize that the vulnerability primarily affects developers who published raw logs with intact reasoning blocks.
Further research is needed to assess whether already-published blocks remain decodable. The study also highlights the lack of public acknowledgment from the affected providers, with the researchers relying on their reproducibility statement for confirmation that the attacks are no longer viable.
This latest discovery builds on previous research by cryptographer Matthew Green, emphasizing the need for ongoing scrutiny and improvement of AI security measures to prevent future vulnerabilities.
