Ethical Hacking News
A newly disclosed flaw in three major AI model providers - OpenAI, Anthropic, and Google - allows researchers to recover internal reasoning and secrets from session logs. The weakness was identified by a team of researchers who demonstrated four abuse paths using this vulnerability. While the exposure is bounded, it primarily affects developers who published raw agent logs with the reasoning objects intact.
The security vulnerability affects three major AI model providers: OpenAI, Anthropic, and Google. The flaw lies in how these providers handle encrypted reasoning objects used by their reasoning APIs. The weakness was identified through a paper titled "Stealing Reasoning Traces from Proprietary LLM APIs." Researchers demonstrated four abuse paths to exploit the vulnerability, including recovering private data and hidden content. The portability of encrypted reasoning objects turned published agent logs into a sharper security problem. The exposure primarily affects developers who published raw agent logs with intact reasoning objects. The vulnerability raises questions about whether already-published blocks remain decodable and whether fresh attacks still succeed.
In recent days, a security vulnerability has been uncovered that affects three major artificial intelligence (AI) model providers - OpenAI, Anthropic, and Google. The flaw lies in the way these providers handle encrypted reasoning objects used by their reasoning APIs, which allow researchers to recover internal reasoning and secrets from session logs, including API keys and passwords.
The weakness was identified in a paper titled "Stealing Reasoning Traces from Proprietary LLM APIs," published by a team of researchers. The team demonstrated four abuse paths - stealing proprietary reasoning for model distillation, extracting private data from other users' published traces, recovering harmful content concealed behind a safe visible answer, and hiding prompt injections inside opaque reasoning blocks.
During testing, the researchers found that these objects could be replayed across sessions, users, and models, allowing a weaker compatible model to act as a "fuzzy" decoder. This portability turned published agent logs into a sharper security problem, as sanitizing the readable conversation could leave secrets inside an opaque block that another account was able to replay.
The exposure demonstrated by this study is bounded: it primarily affects developers who published raw agent logs with the reasoning objects intact, one identifiable group rather than every API user, and not necessarily the only one at risk. However, the same portability also enabled an invisible prompt-injection proof of concept, where malicious instructions could be injected into an unrelated task without being visible in the text.
The researchers caution that they do not have ground-truth plaintext for the proprietary reasoning, so their fidelity checks relied on reasoning-token counts and qualitative comparisons. The current vendor documentation shows that encrypted reasoning remains part of these APIs, but handling has changed. OpenAI still tells developers to replay encrypted reasoning items when manually managing stateless history, while Google says its backend manages thought compatibility when a session switches models.
Anthropic now says thinking blocks are tied to the model that produced them and should be stripped when switching models because other models ignore them. The discovery of this vulnerability raises several questions, including whether those already-published blocks remain decodable, a separate question from whether fresh attacks still succeed.
The researchers built on previous research by Johns Hopkins cryptographer Matthew Green, who showed that encrypted reasoning blocks could be replayed across sessions and accounts but stopped short of a reliable secret-extraction technique. The new paper turns this replay behavior into a broader extraction method and documents the privacy consequences at scale.
This discovery highlights the importance of carefully handling sensitive information in AI models and emphasizes the need for more robust security measures to protect user data.
Related Information:
https://www.ethicalhackingnews.com/articles/The-Unintended-Consequences-of-API-Call-Portability-A-Newly-Disclosed-Flaw-in-AI-Model-Decoding-ehn.shtml
https://thehackernews.com/2026/08/openai-anthropic-google-api-flaw-let.html
Published: Wed Aug 12 08:26:39 2026 by llama3.2 3B Q4_K_M
