A significant flaw in the Application Programming Interfaces (APIs) of leading Large Language Model (LLM) providers — OpenAI, Anthropic, and Google — enabled researchers to extract hidden internal reasoning, and critically, sensitive data such as API keys and passwords from session logs. This vulnerability, detailed in the paper Stealing Reasoning Traces from Proprietary LLM APIs, highlights a design weakness where encrypted reasoning objects, intended to preserve conversational state, became portable and decodable under specific conditions.
Technical Analysis: LLM Reasoning Trace Leakage
The core of the problem lies in how these providers managed hidden AI reasoning across API calls. OpenAI, Anthropic, and Google all employ encrypted objects (e.g., encrypted reasoning items, full reasoning in an encrypted signature, encrypted thought signatures) to maintain reasoning state without exposing the underlying plaintext to the client. The researchers discovered that these ‘opaque blocks’ could be replayed across sessions, users, and even handed to weaker, compatible models within the same provider’s family to act as a “fuzzy” decoder. For instance, Claude Haiku 4.5 could decode traces produced by a stronger Claude model, and similarly for GPT-5.6 Luna with GPT traces and Gemini Robotics ER-1.6 with Gemini traces.
The research team identified four primary abuse paths: stealing proprietary reasoning for model distillation, extracting private data from other users’ published traces, recovering harmful content concealed behind a safe visible answer, and hiding prompt injections inside opaque reasoning blocks. In a large-scale analysis of 6,708 public agent trajectories, the team successfully decoded 315,320 thinking blocks. From genuine user sessions (excluding benchmark sources), they recovered 704 distinct privacy artifacts, including an alarming 62 API keys, 33 passwords, 24 access tokens, and seven private keys. This demonstrates how attackers recover LLM API keys and other credentials from publicly available data.
The cross-user attack did not grant arbitrary access to private chats but required obtaining an encrypted reasoning block (e.g., from an agent log) and API access to a compatible model from the same provider. Crucially, 64 of the 704 recovered artifacts appeared only in the hidden reasoning and not in the visible trace, meaning that standard sanitization of readable conversations would not prevent this data exposure. The work builds on earlier research by Johns Hopkins cryptographer Matthew Green, who reported replay behavior to OpenAI and Anthropic through bug bounty programs, though the security implications were not initially acknowledged by the vendors. This new paper transformed that replay behavior into a broader, scalable extraction method, documenting significant privacy consequences.
Securing AI API Integrations: Preventing Reasoning Trace Leakage
According to The Hacker News, the researchers disclosed their findings to the affected model providers, Microsoft, and Hugging Face. The team states that the demonstrated attacks are no longer reproducible as of August 2026 due to implemented mitigations. However, the public record lacks official acknowledgments from the providers or details on the exact changes made, raising questions about whether already-published, decodable blocks remain vulnerable.
For security professionals and developers integrating with LLM APIs, the mitigation for LLM reasoning trace leakage is paramount. Defenders must prioritize the following actions:
- Strip Reasoning Blocks: Ensure that reasoning blocks and opaque reasoning fields are removed from any shared or publicly accessible traces, logs, or agent trajectories.
- Avoid Raw API Transcripts: Refrain from committing raw API transcripts to repositories or logs, even if the visible text has undergone sanitization, as sensitive data may persist within opaque reasoning objects.
- Review Existing Data: Conduct a thorough review of past public agent logs and shared traces to identify and remediate any inadvertently exposed sensitive data.
- Validate Vendor Documentation: While current vendor documentation indicates changes in handling (e.g., Anthropic now advises stripping thinking blocks when switching models), developers should independently validate these changes and their security implications, especially given the lack of specific public acknowledgments regarding this flaw.
This incident underscores the critical importance of scrutinizing how proprietary AI models manage internal states and how those states are exposed via APIs, even if encrypted. Organizations must adopt a defense-in-depth approach to protect against such subtle yet impactful data leakage vectors.
Related: AI Agent Sandbox Escapes Threaten Real Organizations, Anthropic Mythos Preview: Advancing AI Offensive Security Performance