A recently disclosed vulnerability in the way OpenAI, Anthropic, and Google handle internal AI reasoning between API calls allowed researchers to retrieve hidden reasoning and secrets from session logs, including API keys and passwords This article explores hidden reasoning secrets. . The flaw affected encrypted reasoning objects used by their respective reasoning APIs, where a block created in one session could be replayed into another, even reaching weaker models within the same provider family to reveal the hidden content during testing.
The team behind this paper demonstrated four abuse paths: stealing proprietary reasoning for model distillation, extracting private data from other users' published traces, recovering harmful content concealed behind a safe visible answer, and hiding prompt injections inside opaque reasoning blocks.
After excluding benchmark sources, it identified 704 distinct privacy artifacts from genuine user sessions, including six API keys, three passwords, two access tokens, and seven private keys. During the testing phase, the paper discovered that these objects could be transferred across sessions, users, and models, enabling a weaker compatible model to act as a "fuzzy" decoder: Claude Haiku 4.5 for Claude traces, GPT-5.6 Luna for GPT traces, and Gemini Robotics ER-1.6 for Gemini traces. This work builds upon research by Johns Hopkins cryptographer Matthew Green, who demonstrated that encrypted reasoning blocks could be replayed across sessions and accounts but stopped short of a reliable secret-extraction technique.
