A previously undisclosed weakness in the way OpenAI, Anthropic, and Google package reasoning data between API calls allowed researchers to recover hidden AI thinking and, in some cases, embedded secrets from session logs, including API keys and passwords. The flaw affected encrypted reasoning objects used by each provider’s reasoning APIs, raising fresh questions about how opaque thinking data should be handled when developers share logs, publish agent traces, or manage conversation state across requests.
The research, documented in a paper titled “Stealing Reasoning Traces from Proprietary LLM APIs,” demonstrates that a reasoning block generated in one session could be replayed into another, or even handed to a weaker model within the same provider family, to extract the hidden content. The technique did not break the underlying encryption. Instead, it relied on the providers’ infrastructure accepting intact opaque blocks and forwarding them to a compatible model willing to transcribe their contents.
Four abuses, one root cause
The team outlined four abuse paths enabled by the same portability issue:
- Stealing proprietary reasoning for model distillation, in which a competitor could use a cheaper model to recover the cognitive steps of a flagship system.
- Extracting private data from other users’ published traces, including credentials that were never visible in the readable portion of a conversation.
- Recovering harmful content concealed behind a safe visible answer, where the model had effectively self-censored in its user-facing reply but left the original material in its hidden reasoning.
- Hiding prompt injections inside opaque reasoning blocks, smuggling instructions into sessions that a developer might replay without inspecting the contents.
Across 6,708 public agent trajectories, the researchers decoded 315,320 thinking blocks. After excluding benchmark sources, they counted 704 distinct privacy artifacts from genuine user sessions, including 62 API keys, 33 passwords, 24 access tokens, and seven private keys. The scale of the find underscores how routinely developers publish raw agent logs that still contain opaque reasoning fields.
How the portability worked
The mechanism begins with a design choice intended to preserve reasoning across API calls when conversation state is managed manually or in a stateless configuration. OpenAI can return encrypted reasoning items that applications are expected to replay with manually managed history, Anthropic carries full reasoning in an encrypted signature, and Google uses encrypted thought signatures. These objects preserve reasoning state without exposing the underlying plaintext directly to the client application.
The encryption itself was not cracked, and the attack did not require obtaining an encryption key. It relied on intact opaque blocks being accepted and processed by the provider when replayed. During testing, the paper found those objects portable across sessions, users, and models, allowing a weaker compatible model to act as what the authors describe as a “fuzzy” decoder. Claude Haiku 4.5 was used for Claude traces, GPT-5.6 Luna for GPT traces, and Gemini Robotics ER-1.6 for Gemini traces, each prompted to transcribe reasoning produced by a stronger sibling model.
That cross-user behavior turns published agent logs into the sharper security problem. Of the 704 non-benchmark artifacts the team recovered, 64 appeared only in hidden reasoning and nowhere in the visible trace. Sanitizing the readable conversation could therefore leave secrets inside an opaque block that another account was able to replay and decode.
Scope of the exposure
The exposure demonstrated by the study is bounded. The cross-user attack did not provide arbitrary access to private chats. It required obtaining an encrypted reasoning block, such as one published in an agent log, and API access to a compatible model from the same provider. The risk therefore lands hardest on developers who share raw agent logs with the reasoning objects intact, a group that is identifiable but not necessarily the only one at risk.
The researchers disclosed the findings to the affected model providers, as well as to Microsoft and Hugging Face, and report that the demonstrated attacks stopped working after mitigations. Their reproducibility statement says the main extraction attack is no longer reproducible as of August 2026. The report does not document malicious exploitation in the wild, and there is no indication that the encryption schemes themselves were compromised.
What developers should do now
For practitioners, the practical guidance is straightforward. Developers are advised to strip reasoning blocks and opaque reasoning fields from any shared traces, and to avoid committing raw API transcripts even when the visible text has been sanitized. Teams that publish agent logs for debugging, research, or reproducibility should treat encrypted reasoning objects as sensitive artifacts in their own right, rather than as opaque metadata that can be safely redistributed.
Broader governance questions are also surfacing. The same portability that enabled the four attacks could also enable prompt injection hidden inside a reasoning block, which is harder to detect than injections planted in visible input. Providers are now under pressure to align their reasoning portability with their content policies, ensuring that what a model cannot say visibly cannot be smuggled through a hidden channel. As the industry settles on conventions for sharing and replaying AI reasoning, the incident serves as a reminder that convenience features built around the API can quietly expand the attack surface, and that mitigation is an ongoing obligation rather than a one-time fix.