A newly disclosed AI API vulnerability affecting systems from OpenAI, Anthropic and Google has raised fresh concerns over how hidden reasoning data is handled by some of the world’s most widely used AI platforms.
Researchers found that encrypted reasoning blocks generated by advanced AI models could, in certain cases, be passed to other models from the same provider and decoded into readable text. The issue potentially exposed sensitive information contained inside a model’s hidden reasoning, even when that information never appeared in the visible response shown to users.
The findings were detailed in a research paper titled Stealing Reasoning Traces from Proprietary LLM APIs, published on August 10, 2026, by Alexander Panfilov and other researchers.
How the Vulnerability Worked
Advanced AI models often perform internal reasoning before producing a final answer. These reasoning traces, sometimes referred to as chain-of-thought, are generally kept hidden from users.
To maintain context across API calls, some providers return encrypted reasoning objects that developers can send back during later interactions. The idea is to preserve the model’s reasoning state without revealing what is inside.
Researchers found that the protection had an important weakness.
Encrypted reasoning blocks could, under certain conditions, be reused across different sessions and models within the same provider’s ecosystem. Instead of attempting to crack the encryption, researchers passed the encrypted block to another compatible model and prompted it to reproduce the underlying reasoning.
In effect, the second model could act as a decoder for information that was supposed to remain hidden.
The technique was demonstrated across systems operated by OpenAI, Anthropic and Google.
Researchers Decoded More Than 315,000 Reasoning Blocks
The scale of the research was significant.
According to the study, researchers decoded 315,320 encrypted reasoning blocks collected from publicly available repositories.
Their analysis identified 367 pieces of personally identifiable information and 182 credentials within the recovered data.
This creates a particular concern for developers who publish AI agent logs, debugging records or API transcripts.
A transcript may appear safe after sensitive information has been removed from the visible conversation. However, confidential data could still remain inside encrypted reasoning objects attached to the same record.
That means simply sanitising the readable text may not be enough.
Four Major Risks Identified
The researchers highlighted several ways such a vulnerability could potentially be misused.
One is model distillation, where proprietary reasoning from a more advanced AI model could potentially be extracted and used to improve another model.
Another is private-data extraction. Information processed by an AI system could remain inside its internal reasoning even if it was excluded from the final answer.
Researchers also warned about the possibility of recovering unsafe or harmful information that a model considered internally before ultimately refusing to provide it.
A fourth concern involves invisible prompt injection, where instructions hidden inside opaque reasoning objects could potentially influence later AI interactions without being visible to the user.
The Encryption Itself Was Not Broken
One of the most important aspects of the research is that attackers did not need to steal encryption keys or crack the underlying cryptography.
Instead, the weakness involved how legitimate encrypted reasoning objects were accepted and processed by other models.
That makes the issue less like a traditional encryption failure and more like an architectural problem involving trust, compatibility and isolation between AI models and sessions.
What Developers Should Take Away
The researchers said they responsibly disclosed the findings and proposed stronger cryptographic and system-level protections for reasoning data.
The research also carries a clear warning for developers working with AI agents: encrypted reasoning blocks should be treated as sensitive data.
Publishing raw API transcripts, development logs or agent trajectories may carry privacy risks even when the visible prompts and responses have already been cleaned.
As AI systems increasingly interact with source code, business documents, credentials and private user information, protecting hidden reasoning data is likely to become an increasingly important part of AI API security.
