Researchers extracted 704 API keys, passwords, and tokens from public logs due to a flaw in OpenAI, Anthropic, and Google APIs. The vulnerability allowed weaker models to decode reasoning from stronger models, exposing sensitive data.
TL;DR
- Researchers extracted 704 API keys, passwords, and tokens from public logs due to a flaw in OpenAI, Anthropic, and Google APIs.
- The vulnerability allowed weaker models to act as 'fuzzy' decoders, revealing hidden reasoning and sensitive data.
- The main extraction attack has been mitigated, but questions remain about the security of already-published logs.
What happened
A newly disclosed flaw in the way OpenAI, Anthropic, and Google handled encrypted reasoning objects in their APIs allowed researchers to extract sensitive data from public logs. The team behind the paper 'Stealing Reasoning Traces from Proprietary LLM APIs' demonstrated four abuse paths, including stealing proprietary reasoning, extracting private data, and hiding prompt injections.
The researchers analyzed 6,708 public agent trajectories and decoded 315,320 thinking blocks, finding 704 distinct privacy artifacts, including 62 API keys, 33 passwords, 24 access tokens, and seven private keys. The cross-user attack required obtaining an encrypted reasoning block and API access to a compatible model from the same provider.
The team disclosed the findings to the affected model providers, Microsoft and Hugging Face, and stated that the demonstrated attacks stopped working after mitigations. However, no public acknowledgment of the flaw from any of the three providers has surfaced so far.
Why it matters
This vulnerability highlights the risks of sharing raw agent logs with reasoning objects intact. Developers are advised to strip reasoning blocks and opaque reasoning fields from shared traces to prevent similar incidents.
The flaw underscores the importance of secure design in AI APIs, particularly when handling sensitive data. The portability of encrypted reasoning objects across sessions, users, and models poses a significant security risk.
While the main extraction attack has been mitigated, questions remain about the security of already-published logs and the long-term implications of this vulnerability. The work builds on previous research by Johns Hopkins cryptographer Matthew Green, who showed that encrypted reasoning blocks could be replayed across sessions and accounts.
Key facts
- Researchers extracted 704 distinct privacy artifacts, including 62 API keys, 33 passwords, 24 access tokens, and seven private keys.
- The team analyzed 6,708 public agent trajectories and decoded 315,320 thinking blocks.
- The cross-user attack required obtaining an encrypted reasoning block and API access to a compatible model from the same provider.
- The main extraction attack is no longer reproducible as of August 2026, according to the researchers.
- The vulnerability affected encrypted reasoning objects used by OpenAI, Anthropic, and Google's reasoning APIs.
- Weaker models, such as Claude Haiku 4.5, GPT-5.6 Luna, and Gemini Robotics ER-1.6, were used as 'fuzzy' decoders to reveal hidden reasoning.
- The exposure is bounded to developers who published raw agent logs with the reasoning objects intact.
- The team crafted an opaque reasoning block that carried a malicious instruction, demonstrating an invisible prompt-injection proof of concept.
Context
This vulnerability is part of a broader conversation about the security of AI APIs and the handling of sensitive data. As AI models become more integrated into various applications, ensuring the security of these APIs is crucial.
The work builds on previous research by Johns Hopkins cryptographer Matthew Green, who showed that encrypted reasoning blocks could be replayed across sessions and accounts. The new paper turns that replay behavior into a broader extraction method and documents the privacy consequences at scale.
The disclosure raises questions about the long-term security of AI APIs and the importance of secure design in handling sensitive data. It also highlights the need for better documentation and communication from AI providers about security vulnerabilities and mitigations.
