LIVE FEED
HIGH OpenAI, Anthropic, Google APIs Let Weaker Models Steal Reasoning // HIGH LLM Reasoning Trace Theft via Encrypted Block Replay Attack // FIRST LOOK OpenAI and AWS Launch Daybreak Red and Blue on Amazon Bedrock // CRITICAL CVE-2026-55040: SharePoint RCE Chain Found via AI Agent // FIRST LOOK OpenAI Releases GPT-5.6 Cyber for Approved Security Partners // HIGH GhostJacking Attack Hijacks AI Agents via Security Alerts // FIRST LOOK Cactus Releases Needle 2 Agentic LLM for IoT and Edge Devices // HIGH Google APK Flaw Enables Agent-to-Agent Supply Chain Attack // CRITICAL CVE-2026-41679: Paperclip AI RCE via Malicious Agent Import // FIRST LOOK Anthropic Enables Claude Code Auto Mode by Default for Pro Users //
ATLAS OWASP HIGH Significant risk · Prioritise patching LLM Security Adversarial ML Model Theft Agentic AI Research RELEVANCE ▲ 9.2

OpenAI, Anthropic, Google APIs Let Weaker Models Steal Reasoning

SOURCE The Hacker News ↗
TL;DR HIGH
  • What happened: Encrypted reasoning blocks from OpenAI, Anthropic, and Google APIs were decoded by weaker sibling models, leaking credentials and hidden content.
  • Who's at risk: Developers and organisations who publish or share raw API agent logs containing encrypted reasoning blocks are most exposed, as those blocks can be replayed to extract secrets.
  • Act now: Strip all reasoning blocks and opaque reasoning fields from any shared or published agent traces · Never commit raw API transcripts to repositories, even if the visible text appears sanitised · Audit existing public agent logs and rotate any credentials that may have been included in session history
OpenAI, Anthropic, Google APIs Let Weaker Models Steal Reasoning

Overview

Researchers have disclosed a significant vulnerability affecting the reasoning APIs of OpenAI, Anthropic, and Google. The flaw allowed encrypted reasoning objects — designed to preserve internal chain-of-thought state across stateless API calls — to be replayed across sessions, users, and even model tiers. A weaker model within the same provider family could then act as a ‘fuzzy decoder’, recovering the hidden reasoning content of a stronger model without breaking any encryption. The research paper, Stealing Reasoning Traces from Proprietary LLM APIs, documented four distinct abuse paths and recovered 704 privacy artifacts from genuine user sessions found in public agent trajectories.

Technical Analysis

The three providers implement reasoning state persistence differently but share a common structural weakness:

  • OpenAI returns encrypted reasoning items that applications are expected to replay when managing conversation history manually.
  • Anthropic carries full reasoning in an encrypted signature appended to responses.
  • Google uses encrypted thought signatures to preserve chain-of-thought between turns.

In all three cases, the encryption was not broken. Instead, the researchers discovered that these opaque blocks were accepted and processed by the provider’s inference infrastructure regardless of which session or user originally generated them. By submitting a captured reasoning block to a compatible weaker model — Claude Haiku 4.5 for Anthropic traces, GPT-5.6 Luna for OpenAI traces, and Gemini Robotics ER-1.6 for Google traces — and prompting it to ’transcribe’ the reasoning, the team could recover the hidden content.

Across 6,708 public agent trajectories, the team decoded 315,320 thinking blocks and, after filtering benchmark sources, identified 704 privacy artifacts from real user sessions: 62 API keys, 33 passwords, 24 access tokens, and 7 private keys. The attack also enabled recovery of harmful content hidden behind safe visible responses and injection of prompt payloads inside opaque reasoning blocks that downstream systems would process.

Framework Mapping

  • AML.T0057 (LLM Data Leakage): The core finding — hidden reasoning and embedded credentials leaked via cross-session block replay.
  • AML.T0040 (AI Model Inference API Access): Exploitation required only standard API access to a compatible model.
  • AML.T0056 (LLM Meta Prompt Extraction): Recovery of proprietary reasoning traces constitutes extraction of internal model processing logic.
  • AML.T0051 (LLM Prompt Injection): The paper demonstrated hiding prompt injections inside opaque reasoning blocks.
  • AML.T0083 (Credentials from AI Agent Configuration): API keys, tokens, and passwords were recovered from agent session logs.
  • LLM06 (Sensitive Information Disclosure): The primary OWASP classification given the credential and PII recovery at scale.
  • LLM10 (Model Theft): Proprietary reasoning traces extracted for model distillation constitute a model theft vector.

Impact Assessment

The immediate technical risk has been mitigated by all three providers as of August 2026, and the paper confirms the main extraction attack is no longer reproducible. However, the broader impact is structural: any organisation that published agent logs between the time reasoning APIs launched and the mitigations were deployed may have exposed credentials. The 704-artifact recovery from existing public trajectories demonstrates that historical exposure is a live problem requiring active remediation.

Mitigation & Recommendations

  1. Strip reasoning blocks before sharing: Remove all encrypted reasoning fields, thinking blocks, and opaque signature objects from any agent traces before publication or team sharing.
  2. Do not commit raw API transcripts: Even when visible output appears safe, embedded reasoning objects may carry sensitive state.
  3. Rotate exposed credentials: Audit any agent logs previously made public and treat all API keys, tokens, and passwords found in session history as compromised.
  4. Treat reasoning blocks as sensitive data: Apply the same data handling policies to reasoning objects as to plaintext credentials or PII.

References

◉ AI THREAT BRIEFING

Stay ahead of the threat.

Twice-weekly digest of critical AI security developments — every story mapped to MITRE ATLAS and OWASP LLM Top 10. Free.

No spam. Unsubscribe anytime.