Researchers have uncovered a security weakness in the way OpenAI, Anthropic, and Google handle encrypted AI reasoning data between API calls. The research showed that encrypted reasoning blocks from stronger AI models could, under certain conditions, be replayed to weaker models from the same provider and used to recover hidden reasoning.
The researchers analyzed more than 315,000 reasoning blocks from public AI agent logs and recovered sensitive information, including API keys, passwords, access tokens, and private keys. The findings also raise concerns about AI model distillation, privacy, and the security of shared agent traces.
Importantly, the researchers said the attack did not break the underlying encryption or require obtaining encryption keys. Instead, it exploited how encrypted reasoning objects could be transferred and processed across models and sessions. The affected providers were notified, and the researchers report that the demonstrated attacks are no longer reproducible following mitigations.
Why It Matters
The discovery highlights a new AI security risk: hidden reasoning data can still become sensitive information if encrypted traces are shared, logged, or exposed through AI agent workflows.
Developers should avoid publishing raw AI reasoning traces, remove sensitive data from agent logs, and review how encrypted reasoning objects are stored and transmitted.
