Hidden AI Reasoning Flaw Leaked API Keys and Passwords Across Major LLMs

Researchers have disclosed a critical design flaw in the reasoning APIs of OpenAI, Anthropic, and Google that allowed weaker AI models to decode the internal reasoning traces of stronger models, exposing sensitive user data in the process. The vulnerability, detailed in the paper Stealing Reasoning Traces from Proprietary LLM APIs, exploited how providers such as OpenAI's encrypted reasoning items, Anthropic's encrypted signatures, and Google's encrypted thought signatures were designed to preserve reasoning state across stateless API calls. These opaque blocks were found to be portable across sessions, users, and even model tiers, enabling what the researchers describe as a "fuzzy decoder" attack: Claude Haiku 4.5 could transcribe reasoning from larger Claude traces, GPT-5.6 Luna could extract hidden content from GPT sessions, and Gemini Robotics ER-1.6 could decode Gemini reasoning blocks.

The impact was substantial. Across 6,708 public agent trajectories, the team decoded 315,320 thinking blocks and identified 704 distinct privacy artifacts from genuine user sessions, including 62 API keys, 33 passwords, 24 access tokens, and seven private keys. Four abuse paths were demonstrated: stealing proprietary reasoning for model distillation, extracting private data from other users' published traces, recovering harmful content concealed behind a safe visible answer, and hiding prompt injections inside opaque reasoning blocks. Importantly, the encryption itself was not cracked and no encryption key was needed; the attack relied on the provider accepting and processing intact opaque blocks, making it a design-level weakness rather than a cryptographic break. Developers who published sanitized agent logs may have unknowingly exposed raw credentials, a reminder that visible text stripping is insufficient when underlying reasoning fields remain intact.

The researchers disclosed their findings to all affected providers, including Microsoft and Hugging Face, and the demonstrated attacks stopped working after mitigations were deployed. As of August 2026, the primary extraction attack is no longer reproducible, and no malicious exploitation in the wild has been documented. Nevertheless, the findings carry lasting lessons for AI application developers: raw API transcripts should never be committed or shared without stripping reasoning blocks and opaque fields entirely. Users concerned about credential exposure can verify their accounts using our email breach checker, test leaked credentials with our password checker, and run a full privacy checkup to identify other exposures before threat actors can chain them into broader attacks.