Unmasking AI’s Inner Workings: Critical Flaw Exposes Secrets in OpenAI, Anthropic, and Google APIs

Unmasking AI’s Inner Workings: Critical Flaw Exposes Secrets in Leading LLM APIs

A significant security vulnerability has been uncovered in the Application Programming Interfaces (APIs) of major AI developers, including OpenAI, Anthropic, and Google. This flaw allowed researchers to bypass the intended privacy of AI reasoning processes, effectively enabling weaker AI models to decode the internal thoughts and even extract sensitive data from their more powerful counterparts. The implications are far-reaching, revealing a potential goldmine of proprietary information and user secrets.

The Hidden Mechanism: Encrypted Reasoning Objects

At the heart of this vulnerability lies the design choice by these AI providers to carry ‘hidden AI reasoning’ between API calls. This is typically done using encrypted reasoning objects or ‘thought signatures’ – mechanisms designed to preserve the AI’s conversational state without directly exposing its complex internal processing to the client. OpenAI, for instance, uses encrypted reasoning items for stateless history management, Anthropic employs encrypted signatures, and Google utilizes encrypted thought signatures. The intention is sound: maintain context efficiently. However, researchers discovered that these opaque blocks, while encrypted, were not securely bound to their original session or model.

A Digital Heist: Recovering Sensitive Data

The team behind the paper “Stealing Reasoning Traces from Proprietary LLM APIs” demonstrated that these encrypted blocks could be replayed into different sessions and, critically, even fed to a weaker, compatible model from the same provider family. This ‘fuzzy decoder’ model was then prompted to transcribe the reasoning produced by the stronger model, effectively revealing its hidden content. The results were alarming:

• Out of 6,708 public agent trajectories analyzed, 315,320 thinking blocks were decoded.
• From genuine user sessions (excluding benchmarks), 704 distinct privacy artifacts were recovered.
• These artifacts included 62 API keys, 33 passwords, 24 access tokens, and seven private keys.

Crucially, 64 of these non-benchmark artifacts were found exclusively within the hidden reasoning, not in the visible conversation trace, highlighting a significant blind spot in traditional data sanitization methods.

Four Avenues of Abuse

The researchers outlined four primary abuse paths stemming from this flaw:

1. Model Distillation: Stealing proprietary reasoning to train smaller, less powerful models, potentially undermining the intellectual property of leading AI firms.
2. Private Data Extraction: Recovering sensitive user data, such as API keys and passwords, from published agent logs.
3. Harmful Content Recovery: Unearthing malicious or unsafe content that AI models were designed to conceal behind seemingly safe, visible responses.
4. Invisible Prompt Injections: Embedding malicious instructions within opaque reasoning blocks, which could then be replayed into unrelated tasks, causing the receiving model to execute attacker-directed actions without any visible indication to the user.

The ‘Fuzzy Decoder’ in Action

The core of the attack leveraged the portability of these encrypted reasoning objects across sessions, users, and even models within the same provider family. For example, Claude Haiku 4.5 could decode Claude traces, GPT-5.6 Luna for GPT traces, and Gemini Robotics ER-1.6 for Gemini traces. This meant that a less capable, often cheaper, model could be used to extract the sophisticated internal logic of a premium model, turning publicly shared agent logs into significant security liabilities.

Mitigation and Unanswered Questions

The researchers promptly disclosed their findings to the affected providers, including OpenAI, Anthropic, Google, Microsoft, and Hugging Face. They report that the demonstrated attacks ceased to function following mitigations, with the main extraction attack no longer reproducible as of August 2026. While vendor documentation has been updated regarding the handling of encrypted reasoning, no public acknowledgment of the flaw from the three primary providers has surfaced, nor have they explicitly linked their documentation changes to this research. This leaves the public relying solely on the researchers’ reproducibility statement for confirmation of the fix. The same record shows the team decoded hundreds of such traces, underscoring the scale of the potential exposure.

Advice for Developers

Even with mitigations in place, developers are strongly advised to exercise caution:

• Strip reasoning blocks and opaque reasoning fields from any shared traces or logs.
• Avoid committing raw API transcripts, even if the visible text has been sanitized, as hidden secrets may persist.

This incident underscores the complex security challenges inherent in advanced AI systems, particularly when internal mechanisms, designed for efficiency, inadvertently create new attack vectors for sensitive information.

For more details, visit our website.

Source: Link