Major AI providers built encrypted reasoning objects into their APIs to maintain state across stateless calls. Those same objects turned out portable enough for weaker models to decode stronger ones’ hidden traces.
Researchers recovered thousands of private artifacts this way. Their work, published in a paper titled Stealing Reasoning Traces from Proprietary LLM APIs, showed how session logs posted online could leak API keys, passwords, and tokens even when visible output stayed clean.
Portability turned a convenience feature into an extraction vector
The flaw centered on encrypted reasoning blocks returned by OpenAI, Anthropic, and Google. Applications replayed these blocks to preserve chain-of-thought across manual history management. The blocks survived replay across sessions, accounts, and even model tiers within the same family.
A weaker model could transcribe the stronger model’s thinking when handed an intact block. Claude Haiku decoded Claude Opus traces. GPT variants worked the same way. Gemini’s equivalent followed the pattern too. No key compromise occurred. The providers simply accepted and processed the opaque objects as designed.
Analysis of 6,708 public agent trajectories yielded 315,320 decoded thinking blocks. After filtering benchmarks, 704 distinct privacy items surfaced from real user sessions. Among them sat 62 API keys, 33 passwords, 24 access tokens, and seven private keys. Many appeared only inside the hidden reasoning and never in visible text.
And that exposed a sharper problem for anyone sharing raw logs. Sanitizing readable output left secrets intact inside replayable blocks. Developers who published agent trajectories on repositories handed attackers ready material.
Additional abuse paths emerged from the same design
Researchers built proof-of-concept prompt injections inside opaque blocks. A malicious instruction hidden in reasoning could trigger actions on later replay without appearing in visible prompts. The attack worked across unrelated tasks.
Model distillation became feasible too. Proprietary reasoning traces from frontier models could feed training of weaker copies. Harmful content concealed behind safe answers also surfaced during extraction tests.
The team disclosed findings to OpenAI, Anthropic, Google, Microsoft, and Hugging Face. Attacks stopped working after changes. Reproducibility checks from August 2026 confirm the main extraction no longer succeeds in fresh tests. Documentation now advises stripping reasoning blocks before sharing or switching models in some cases.
Prior work laid groundwork. Matthew Green demonstrated replay across sessions in May 2026. Vendors initially saw limited risk. The new paper scaled the issue and quantified privacy leaks at volume.
Current vendor pages still reference encrypted reasoning for certain workflows. OpenAI continues to document replay for manual state. Google notes backend handling during model switches. Anthropic ties blocks more tightly to their originating model.
No public statements from the providers link directly to this research yet. Questions remain about blocks already published in public repositories. Those objects could retain extractability even if new attacks fail.
Enterprises running agent systems face concrete choices now. Strip opaque fields from logs. Treat raw transcripts as sensitive even after visible sanitization. Audit any shared trajectories for hidden artifacts.
Related reporting from Cybersecurity News on August 11, 2026, highlights the same architectural exposure across the three providers’ ecosystems. The pattern shows how convenience features in high-scale APIs can create downstream exposure when state objects prove more reusable than intended.