Researchers steal hidden AI reasoning traces via API flaw

Security researchers have described a weakness in the APIs of OpenAI, Anthropic and Google: the encrypted "reasoning" blocks where models store their hidden thinking steps could be replayed across sessions and users. Weaker models from the same provider family could thus decode the hidden reasoning of stronger models, The Hacker News reports.

The paper, titled "Stealing Reasoning Traces from Proprietary LLM APIs," was published as a preprint and builds on earlier observations by Johns Hopkins cryptographer Matthew Green. The core problem: what stays invisible to users was not securely sealed.

The scale is significant. Across 6,708 public agent trajectories, the researchers say they decoded 315,320 thinking blocks and recovered 704 distinct privacy artifacts from genuine user sessions - including 62 API keys, 33 passwords, 24 access tokens and seven private keys.

Especially sensitive: "64 appeared only in hidden reasoning and nowhere in the visible trace," the paper notes. Sanitizing the visible conversation alone would not have protected those secrets.

According to the researchers, the main attack is no longer reproducible as of August 2026 after mitigations took hold. Public confirmation from the three providers is still lacking, and encrypted reasoning remains part of their APIs. The lesson for companies is clear: keep secrets out of prompts and rotate credentials regularly.