OpenAI, Anthropic, Google API Flaw Let Weaker AI Models Decode Stronger Models' Reasoning
13:47 · August 12, 2026 · Hacker News AI Section
A newly disclosed flaw in the way OpenAI, Anthropic, and Google carried hidden AI reasoning between API calls let researchers recover internal reasoning and secrets from session logs, including API keys and passwords. The weakness affected encrypted reasoning objects used by the providers' reasoning APIs, where a block created in one session could be replayed into another and, during testing,
Summary
A newly disclosed vulnerability in the reasoning APIs of OpenAI, Anthropic, and Google allowed encrypted reasoning blocks to be replayed across sessions and decoded by weaker models within the same provider family. These blocks were designed to preserve internal reasoning state when applications manage conversation history manually or statelessly, without exposing plaintext to the client. Researchers showed that the objects remained portable across sessions, users, and models, enabling a weaker model to transcribe the hidden content produced by a stronger one.
The study, titled Stealing Reasoning Traces from Proprietary LLM APIs, identified four practical attack paths. These included distilling proprietary reasoning traces, extracting private data from other users’ published logs, recovering concealed harmful content behind sanitized visible outputs, and embedding invisible prompt injections inside opaque blocks. In an analysis of 6,708 public agent trajectories, the team decoded 315,320 thinking blocks and isolated 704 distinct privacy artifacts from genuine user sessions, among them 62 API keys, 33 passwords, 24 access tokens, and seven private keys. Sixty-four of these artifacts appeared exclusively in the encrypted reasoning and not in the visible trace.
The attacks required only an intact encrypted block, such as one published in an agent log, plus API access to a compatible model; they did not involve breaking encryption or obtaining keys. The researchers disclosed their findings to the affected providers and reported that the demonstrated attacks ceased to work after subsequent mitigations, though no vendor has publicly confirmed the changes or addressed the status of already-published blocks. Earlier work by Johns Hopkins cryptographer Matthew Green had identified the replay behavior but did not develop a reliable extraction method.
Developers are advised to remove reasoning blocks and opaque fields from any shared traces, even when visible text has been sanitized. Current documentation still references encrypted reasoning for stateless operation, but handling recommendations have diverged across providers, leaving several questions about residual exposure unresolved.
Why it matters
Provides actionable security guidance for Dutch teams using major LLM APIs under GDPR and EU AI Act requirements, highlighting real privacy risks from opaque reasoning objects in agent logs.
