A newly disclosed security issue has raised serious concerns about how large language model (LLM) providers handle hidden reasoning across API calls. Researchers describe an AI API flaw that allowed them to recover internal reasoning details—and, in some cases, sensitive secrets—from session logs. The findings focus on encrypted reasoning objects that were supposed to preserve conversational state without revealing plaintext to applications.
Importantly, the paper does not describe confirmed abuse in the wild. Instead, it shows that specific developers and publishing practices could unintentionally turn logs into a security liability.
What the AI API flaw actually involved
The core weakness, as described by the researchers, lies in encrypted reasoning blocks used by reasoning APIs. These blocks are designed to maintain reasoning continuity when an application manages conversation state manually or runs in a stateless way. In practice, providers return opaque items that can be replayed later so the system can continue thinking without exposing the underlying reasoning text directly to the client.
The researchers’ key observation was that these opaque blocks could be accepted and processed across sessions, accounts, and even compatible models within the same provider family. They did not rely on breaking encryption or obtaining encryption keys. Instead, the attack hinged on intact, port-able blocks being replayed in another context.
How researchers turned logs into decoded reasoning
The study behind the results—titled around stealing reasoning traces from proprietary LLM APIs—mapped multiple abuse paths. One path focused on recovering proprietary reasoning to enable model distillation. Another path targeted private information that was unintentionally included when users published traces. A third showed how harmful content could be concealed behind a safe visible answer and still be recoverable from the hidden layer.
They also documented a technique to hide prompt-injection instructions inside opaque reasoning blocks. The receiving model could then perform attacker-directed actions even when the injected instruction never appeared in the visible text of the prompt.
To evaluate scale, the team analyzed 6,708 public agent trajectories. Across those, they decoded 315,320 thinking blocks. After removing benchmark sources, they reported 704 distinct privacy artifacts linked to genuine user sessions.
What kind of secrets were recovered
The privacy artifacts reported in the paper included multiple categories of sensitive data. The researchers counted 62 API keys, 33 passwords, 24 access tokens, and 7 private keys. In addition, they observed that some recovered items appeared only in hidden reasoning and not in the readable conversation trace.
That last detail matters: even if a developer sanitizes the visible message content, secrets can still remain inside opaque reasoning blocks. Those blocks could then be replayed by another account under the right conditions.
Conditions required for cross-user replay
While the findings are alarming, the researchers emphasize that the cross-user attack was bounded. It was not described as enabling arbitrary access to private chats. Instead, the attacker needed two ingredients:
- An encrypted reasoning block that could be obtained from something like a published agent log
- API access to a compatible model from the same provider
The study also describes how a “weaker compatible model” could act as a decoder. During testing, they prompted models such as Claude Haiku 4.5 for Claude traces, GPT-5.6 Luna for GPT traces, and Gemini Robotics ER-1.6 for Gemini traces. The idea was to transcribe or reveal the hidden reasoning produced by a stronger model.
What the paper found about stealth and prompt injection
Beyond secret recovery, the research reports an “invisible” proof of concept for prompt injection. In their construction, they crafted an opaque reasoning block that carried a malicious instruction. Later, they replayed that block into an unrelated task.
In the demonstration, the receiving model added an attacker-directed upload action without exposing the injected instruction in visible text. This suggests that opaque reasoning content can become a covert instruction channel—especially when logs are shared and later replayed.
Why this didn’t require cracking encryption
Cracking the encryption was not part of the threat model. The study states that the encryption itself was not cracked and that no encryption keys were needed. The vulnerability depended on the provider backend still accepting and processing intact opaque blocks.
In other words, the system’s design to preserve reasoning state across calls created an interoperability-like weakness: blocks created in one session could be replayed elsewhere, with the backend treating them as valid reasoning state.
Mitigations: what changed after disclosure
According to the researchers, they disclosed the findings to the affected providers, including Microsoft and Hugging Face. They also report that the demonstrated attacks stopped working after mitigations were applied.
The reproducibility statement in the paper says the main extraction attack was no longer reproducible as of August 2026. That does not automatically mean every variant is fixed, but it indicates the most straightforward path was addressed.
Provider handling appears to have evolved
The paper describes differences in how encrypted reasoning is currently documented and how handling changed over time. For example, it notes that guidance about replaying encrypted reasoning items remains present in some contexts, especially when managing stateless history. It also describes documentation suggesting that backend-managed “thought compatibility” helps when sessions switch models.
For another provider, the researchers report a change: thinking blocks are tied to the model that produced them, and developers should strip them when switching models because other models ignore them.
These shifts reinforce the broader message: developers should treat reasoning artifacts as sensitive data and follow current guidance for safe handling, especially when traces are shared.
What’s still unclear from public records
The public record in the study raises open questions. The researchers did not see a public acknowledgment of the issue from any of the three providers at the time of writing. They also state that none had directly tied its current documentation to the research, meaning the evidence of fix effectiveness rests partly on the researchers’ own reproducibility testing.
Another unresolved topic is whether already-published reasoning blocks remain decodable. The team reports decoding hundreds of thousands of blocks already present in public repositories, but whether those older blocks still work under current mitigations is a separate question from whether fresh attacks succeed.
Best practices for developers sharing agent traces
Even if the most direct attack path is reported as mitigated, the study highlights a practical lesson: publishing logs can unintentionally leak more than the visible text suggests. The researchers advise developers to take protective steps when exporting, sharing, or storing agent traces.
- Strip reasoning blocks and any opaque reasoning fields from traces before sharing.
- Avoid committing or uploading raw API transcripts, even if you sanitize the readable conversation.
- Assume sensitive content can live outside the visible layer—inside encoded or encrypted objects.
- Review how your system manages conversation state across calls, especially if you replay reasoning items.
These measures reduce the chance that a future replay scenario—by you or by someone else—could reconstruct hidden content.
Related research and why this matters now
The work builds on earlier findings, including research by Johns Hopkins cryptographer Matthew Green, who reportedly showed that encrypted reasoning blocks could be replayed across sessions and accounts. In that earlier work, the results stopped short of a reliable secret-extraction technique.
In the new paper, the researchers move from replay behavior to a broader extraction method, documenting privacy consequences at scale. That expansion—from “it can be replayed” to “it can be used to recover privacy artifacts”—is what makes this AI API flaw particularly urgent for teams that publish agent logs.
Conclusion
The disclosed AI API flaw shows how hidden reasoning artifacts can become an unexpected exposure path when encrypted blocks are replayed across sessions, accounts, and compatible models. While the paper reports that mitigations stopped the main extraction attack as of August 2026, the findings underline a clear responsibility for developers: treat reasoning objects as sensitive data, and remove them from any shared traces.
For teams building with LLM APIs, the safest approach is straightforward: export only what you need, sanitize beyond the visible text, and never assume that hidden layers are automatically harmless.
Source: https://thehackernews.com/2026/08/openai-anthropic-google-api-flaw-let.html
