OpenAI, Anthropic, Google API Flaw Leaked Encrypted Reasoning
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- OpenAI, Anthropic, and Google carried a flaw in encrypted reasoning objects that could be replayed across sessions and decoded by weaker compatible models — Claude Haiku 4.5, GPT-5.6 Luna, and Gemini Robotics ER-1.6 — during the research team's testing.
- The paper "Stealing Reasoning Traces from Proprietary LLM APIs" documented four abuse paths: stealing reasoning for model distillation, extracting private data from other users' published traces, recovering harmful content hidden behind safe answers, and hiding prompt injections inside opaque reasoning blocks.
- Across 6,708 public agent trajectories, the team decoded 315,320 thinking blocks and recovered 704 distinct privacy artifacts from genuine user sessions — including 62 API keys, 33 passwords, 24 access tokens, and seven private keys.
- Visible-text sanitization proved insufficient: 64 of the 704 artifacts appeared only in hidden reasoning blocks, meaning developers who strip readable text from shared logs could still leak secrets through opaque reasoning objects.
- The encryption itself was not cracked; the attack relied on opaque blocks being accepted and processed by the provider's own models, and the researchers' reproducibility statement says demonstrated attacks stopped working after mitigations as of August 2026.
- The work extends Matthew Green's May research, which showed replay behavior across sessions and accounts but lacked a reliable extraction technique; Green reported his findings to OpenAI (which called them "unreproducible") and Anthropic (which saw no security implications).
- No public acknowledgment of the flaw has come from any of the three providers, so the claim that demonstrated attacks no longer work rests on the researchers' own reproducibility statement rather than vendor confirmation.
Why it matters: The flaw exposes a design blind spot in reasoning APIs: encryption protected against external snooping but not against the provider's own weaker models serving as decoders when fed opaque blocks. Developers who published raw agent logs now face latent exposure, since stripping visible text does not remove secrets buried in reasoning objects — and no provider has publicly tied its current documentation to this research.
Ask SkimNews
