Researchers found a flaw in encrypted AI reasoning traces

Researchers have described an architectural flaw in encrypted reasoning objects used by OpenAI, Anthropic and Google APIs. The paper says these opaque blocks, which preserve hidden reasoning across manually managed API conversations, were portable across sessions, users and compatible models inside a provider ecosystem.

That portability created a practical leak. The researchers say a weaker compatible model could be prompted to decode a reasoning block produced by a stronger model, exposing hidden chain-of-thought. In a scan of public agent trajectories, they decoded 315,320 reasoning blocks and reported hundreds of privacy artifacts from real user sessions, including API keys, passwords, access tokens and private keys.

The exposure was bounded: attackers needed access to an encrypted reasoning block, such as one published in a raw agent log, and the study does not claim arbitrary access to private chats or known exploitation in the wild. The authors also say the main extraction attack is no longer reproducible after provider mitigations.

The practical lesson is still sharp for developers: do not publish or commit raw API transcripts with reasoning objects intact. Sanitizing only the visible text may leave secrets inside hidden reasoning fields.