OpenAI, Anthropic, Google API Flaw Leaked Hidden Reasoning and API
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Researchers behind the paper "Stealing Reasoning Traces from Proprietary LLM APIs" demonstrated that encrypted reasoning objects from OpenAI, Anthropic, and Google could be replayed across sessions and decoded by weaker models acting as "fuzzy" decoders — Claude Haiku 4.5 for Claude traces, GPT-5.6 Luna for GPT traces, and Gemini Robotics ER-1.6 for Gemini traces.
- Across 6,708 public agent trajectories, the team decoded 315,320 thinking blocks and counted 704 distinct privacy artifacts from genuine user sessions, including 62 API keys, 33 passwords, 24 access tokens, and seven private keys — with 64 artifacts appearing only in hidden reasoning and nowhere in the visible trace.
- The paper outlines four abuse paths: stealing proprietary reasoning for model distillation, extracting private data from other users' published traces, recovering harmful content concealed behind safe visible answers, and hiding prompt injections inside opaque reasoning blocks that leave no visible trace of the injected instruction.
- OpenAI, Anthropic, and Google did not have their encryption cracked — the attack relied on intact opaque blocks being accepted by the provider — and the researchers say the demonstrated attacks stopped working after mitigations, with the main extraction attack no longer reproducible as of August 2026.
- The work builds on May research by Johns Hopkins cryptographer Matthew Green, who reported replay behavior to OpenAI (called unreproducible) and Anthropic (said it saw no security implications); no public acknowledgment from any of the three providers has surfaced since the new paper, leaving the fix story resting on the researchers' own reproducibility statement rather than vendor confirmation.
- Anthropic's current documentation now ties thinking blocks to the producing model and instructs developers to strip them when switching models, while OpenAI still tells developers to replay encrypted reasoning items when manually managing stateless history and Google says its backend manages thought compatibility on model switches.
- The exposure is bounded to developers who published raw agent logs with reasoning objects intact rather than every API user, though the same portability also enabled an invisible prompt-injection proof of concept that caused a receiving model to add an attacker-directed upload action without any visible injection text.
Why it matters: Sanitizing visible chat text is not enough — 64 of 704 recovered secrets lived only inside opaque reasoning blocks, so any developer who committed raw agent transcripts to a public repo between the May Green disclosure and August 2026 may have leaked credentials they cannot see in their own logs. The lack of any public vendor acknowledgment means teams relying on these reasoning APIs have no official patch notes to audit and must strip opaque reasoning fields themselves.
Ask SkimNews
