Replay weakness exposed hidden reasoning in major AI APIs
Researchers have disclosed a weakness affecting encrypted reasoning objects in APIs from OpenAI, Anthropic and Google. In tests, the flaw enabled the recovery of hidden reasoning and secrets from public agent logs. Across 6,708 public trajectories, the researchers decoded 315,320 thinking blocks and identified 704 distinct privacy artifacts from genuine user sessions after excluding benchmark material.
The artifacts included 62 API keys, 33 passwords, 24 access tokens and seven private keys. The team said 64 of the 704 artifacts appeared only in hidden reasoning, not in the visible trace. That means a developer could sanitize the readable conversation while leaving sensitive material inside an opaque reasoning object.
Opaque blocks could be replayed across contexts
The affected mechanisms are designed to preserve model reasoning when applications manage conversation history manually or operate statelessly. OpenAI returns encrypted reasoning items, Anthropic uses encrypted signatures for full reasoning, and Google uses encrypted thought signatures. Clients cannot directly read the plaintext in these objects.
The researchers did not crack encryption or obtain encryption keys. Instead, they found that intact objects could be accepted and processed across sessions, users and, in testing, models within the same provider family. A weaker compatible model could then be prompted to transcribe reasoning made by a stronger one. The paper calls this model a “fuzzy” decoder.
Its demonstrations used Claude Haiku 4.5 for Claude traces, GPT-5.6 Luna for GPT traces, and Gemini Robotics ER-1.6 for Gemini traces. The cross-user scenario required an encrypted reasoning block, such as one exposed in a published agent log, plus API access to a compatible model from the same provider. It did not provide arbitrary access to private chats.
Risks extend beyond exposed credentials
The paper, titled Stealing Reasoning Traces from Proprietary LLM APIs, describes four abuse paths: extraction of proprietary reasoning for model distillation, recovery of private data in published traces, disclosure of harmful content hidden behind a safe visible answer, and prompt injection concealed in an opaque block. In one proof of concept, a replayed block carried a malicious instruction that led a receiving model to add an attacker-directed upload action without exposing that instruction in visible text.
The disclosure also adds context to agent-related security incident trends by showing how agent-related security incidents can arise from data and state artifacts surrounding a model, rather than only from visible prompts or outputs. The authors caution that they lack ground-truth plaintext for proprietary reasoning, so reconstructed traces cannot be guaranteed to be exact copies; their fidelity checks compared token counts and qualitative output characteristics.
Mitigations reported, but open questions remain
The researchers disclosed the findings to OpenAI, Anthropic, Google, Microsoft and Hugging Face. They say the attacks they demonstrated stopped working after mitigations, and their reproducibility statement says the main extraction technique is no longer reproducible as of August 2026. The report documents no malicious exploitation in the wild.
Public vendor documentation still describes encrypted reasoning features, with changed handling. OpenAI advises replaying encrypted items for manually managed stateless history; Google says its backend manages thought compatibility when a session changes models; and Anthropic says thinking blocks are tied to their originating model and should be stripped when switching models. No public acknowledgment tying current documentation to this research has surfaced from the three providers, and the public record does not resolve whether already published blocks remain decodable. Businesses should remove reasoning objects from shared traces and repositories, and treat raw API transcripts as sensitive records even when their visible text has been redacted.