A new security vulnerability allows attackers to decrypt the hidden reasoning traces that AI models like those from OpenAI, Google, and Anthropic generate before producing their final answers. Researchers discovered that encrypted reasoning blocks, which these companies use to protect intellectual property, are fully compatible and interchangeable across different sessions, users, and even different models within the same provider's ecosystem. This architectural flaw enables attackers to force weaker, less-safeguarded models to decode and output proprietary reasoning in plaintext.

How Does This Vulnerability Actually Work?

Leading AI providers have shifted away from returning step-by-step reasoning, or chain-of-thought, in plaintext to users. Instead, they encrypt these internal thought processes and return them as opaque blocks of text that clients pass back with each subsequent request. This stateless design avoids the overhead of storing reasoning server-side, but it introduces a critical security gap. The vulnerability stems from a fundamental asymmetry within model families: frontier models like Claude Opus 4.8 or GPT-5.6 Sol are heavily safeguarded with advanced refusal training designed to prevent disclosure of their internal chains of thought, while their weaker siblings, such as Claude Haiku 4.5 or GPT-5.6 Luna, are optimized for cost and speed and often lack these stringent anti-distillation defenses.

Attackers exploit this gap by capturing an encrypted reasoning trace from a capable, heavily safeguarded target model and injecting it into a weaker, less restricted model from the same provider family. The weaker model then decodes and transcribes the trace verbatim in plaintext, effectively bypassing the encryption without ever directly jailbreaking the more capable target model.

What Real-World Data Have Researchers Already Recovered?

The practical consequences of this vulnerability extend far beyond intellectual property theft. Developers frequently share their session logs and encrypted thinking traces publicly online, entirely unaware of the sensitive data hidden within the encrypted blocks. Researchers scraped and decoded 315,320 reasoning blocks from public repositories and uncovered significant data leaks.

• Personally Identifiable Information: The researchers recovered 367 PII artifacts from decoded reasoning blocks, including sensitive personal details that users never intended to expose publicly.
• Credentials and API Keys: A total of 182 credentials were recovered, including 62 API keys, 33 passwords, and 30 personal emails extracted from genuine user sessions.
• Hidden Information Leakage: In some cases, the recovered PII did not even feature in the user's input, having been injected invisibly from the model's memory or bypassing sanitization efforts because users could not read the encrypted text before sharing it.

What Are the Four Main Attack Vectors?

The vulnerability enables multiple distinct attack vectors that go beyond simple data theft. Researchers identified four concrete cases of abuse enabled by this flaw.

• Distillation of Proprietary Reasoning: Attackers can extract a proprietary model's reasoning across Anthropic, OpenAI, and Google, allowing competitors to reverse-engineer the internal logic of frontier models without direct access to model weights.
• Large-Scale Private Data Extraction: By decoding reasoning blocks scraped from public repositories, adversaries can recover credentials, personal information, and sensitive data that developers unknowingly exposed.
• Extraction of Hazardous Information: The vulnerability can reveal harmful information hidden within the reasoning process, even in cases where the model's final, visible output safely rejects a malicious request, exposing safety mechanisms.
• Invisible Prompt Injection: Attackers can leverage this flaw to execute invisible prompt injections, embedding malicious payloads entirely within encrypted blocks to poison public agentic rollouts and compromise downstream systems.

How Can Organizations Protect Themselves?

Following responsible disclosure, researchers have proposed concrete cryptographic and system-level mitigations to secure client-side reasoning. Organizations using these APIs should take immediate steps to reduce their exposure to this vulnerability.

• Audit Public Repositories: Organizations should search for and remove any session logs or encrypted reasoning blocks they may have inadvertently committed to public repositories, GitHub, or other publicly accessible locations.
• Implement Server-Side Storage: Rather than relying on clients to pass encrypted blocks back with each request, providers should consider storing reasoning traces server-side and using session tokens instead, eliminating the portability of encrypted blocks.
• Strengthen Model-Level Defenses: All models within a provider's ecosystem, not just frontier models, should receive consistent anti-distillation training and refusal mechanisms to prevent weaker models from being used as decryption oracles.
• Use Cryptographic Binding: Encrypt reasoning blocks with cryptographic material tied to specific sessions, users, or models to prevent cross-model and cross-session compatibility and interchangeability.

The discovery underscores a broader challenge in the AI industry: as reasoning models become more sophisticated and generate increasingly sensitive internal information, the infrastructure protecting that information must evolve accordingly. The vulnerability affects not just individual users but entire organizations relying on these APIs for production systems. The fact that researchers recovered real credentials and personal information from public logs suggests that this vulnerability has likely already been exploited in the wild, even if undetected.

This research highlights the tension between convenience and security in API design. The stateless architecture that avoids server-side storage overhead introduces a security liability that may ultimately prove more costly than the infrastructure savings it provides. As AI providers continue to roll out reasoning models across their platforms, addressing this vulnerability will become increasingly urgent.