Flaw in AI Reasoning APIs Exposes Secrets and Private Data

## AI Reasoning API Flaw Exposes Secrets and Private Data A recent study has revealed a significant flaw in the AI reasoning APIs of OpenAI, Anthropic, and Google, which allows researchers to recover internal reasoning and secrets from session logs. The weakness affects encrypted reasoning objects used by the providers' reasoning APIs, making it possible to replay a block created in one session into another and even hand it to a weaker model in the same provider family to reveal hidden content. ## The Study's Findings The researchers behind the study, which is titled "Stealing Reasoning Traces from Proprietary LLM APIs," demonstrated four abuse paths, including stealing proprietary reasoning for model distillation, extracting private data from other users' published traces, recovering harmful content concealed behind a safe visible answer, and hiding prompt injections inside opaque reasoning blocks. Across 6,708 public agent trajectories, the team decoded 315,320 thinking blocks, including 62 API keys, 33 passwords, 24 access tokens, and seven private keys. ## The Attack's Limitations The cross-user attack did not provide arbitrary access to private chats, but rather required obtaining an encrypted reasoning block and API access to a compatible model from the same provider. The researchers disclosed the findings to the affected model providers, Microsoft and Hugging Face, and say that the demonstrated attacks stopped working after mitigations. However, the public record does not show any public acknowledgment of the flaw from the providers, and the account that the demonstrated attacks no longer work rests on the researchers' own reproducibility statement. ## The Implications of the Flaw The study's findings have significant implications for the security of AI reasoning APIs. The researchers caution that developers should strip reasoning blocks and opaque reasoning fields from shared traces and avoid committing raw API transcripts, even when the visible text has been sanitized. The study also highlights the importance of proper handling of encrypted reasoning objects to prevent replay attacks. ## The Future of AI Reasoning API Security The study's findings raise several questions about the security of AI reasoning APIs, including whether already-published blocks remain decodable and whether fresh attacks still succeed. The researchers have built on previous research by Johns Hopkins cryptographer Matthew Green, who showed that encrypted reasoning blocks could be replayed across sessions and accounts but stopped short of a reliable secret-extraction technique. The new paper turns that replay behavior into a broader extraction method and documents the privacy consequences at scale.