A significant architectural flaw in how major AI providers, including OpenAI, Anthropic, and Google, protect the internal “chain-of-thought” reasoning generated by their flagship large language models (LLMs).
The research reveals that encrypted reasoning envelopes returned by provider APIs can be replayed into weaker, less-guarded sibling models to extract private reasoning traces in plain text.
Detailed by a collaborative research team from the ELLIS Institute Tübingen, the Max Planck Institute, MATS Research, and Snyk, the attack affects the Claude, GPT, and Gemini model ecosystems and requires only standard, unprivileged API access.
APIs Flaw Exposes Hidden Reasoning Traces
Modern reasoning architectures such as GPT-5.6, Claude Opus 4.8, and Gemini 3 construct hidden chain-of-thought processing traces prior to returning a final response.
Because these internal thoughts contain commercial intellectual property and safety checks, vendors withhold them in plain text.
Instead, APIs transmit the reasoning trace as an encrypted, base64-encoded envelope that the client application passes back on subsequent calls to maintain multi-turn conversational context without requiring server-side state storage.
However, researchers discovered that these encrypted payloads are authenticated using a global, provider-wide key rather than being cryptographically bound to a specific user account, session ID, or model tier.
Because the cryptographic signatures lack model-specific binding, an encrypted envelope created by a heavily guarded flagship model can be legally passed into any other model hosted under the same provider’s infrastructure.
Exploiting such widespread implementation gaps demonstrates how unmitigated API security vulnerabilities can compromise sensitive cloud services. The attack chain operates by utilizing cheaper, lightweight models as decryption oracles.
An adversary captures an encrypted reasoning block emitted by a frontier model (such as Claude Opus 4.8) and injects it into the API call of a smaller model (such as Claude Haiku 4.5), instructing the smaller model to transcribe the internal thinking verbatim inside custom text tags.
Decoding reasoning traces in Anthropic, OpenAI, and Google APIs (Image Source: Arxiv.org)
Because lighter models lack the aggressive anti-distillation alignment and safety guardrails enforced on flagship tiers, they comply with the prompt and output the hidden reasoning in plain text.
As detailed in the research paper published on ArXiv, the team confirmed identical cross-model compatibility across OpenAI’s GPT-5.6 family and Google’s Gemini 3 lineup.
The researchers validated the mathematical precision of the recovered traces by matching decoded token lengths against the billable thinking token counts reported by the provider APIs.
The real-world security implications extend well beyond model distillation or intellectual property theft. By analyzing 6,708 public agent transcripts scraped from GitHub and Hugging Face, the researchers decoded 315,320 embedded reasoning blocks, recovering:
367 Personally Identifiable Information (PII) artifacts
182 Hardcoded credentials (including 62 API keys, 33 passwords, and 30 personal email addresses)
Crucially, much of this sensitive data resided solely within the internal reasoning blocks and was never rendered in the visible assistant responses, leaving developers unaware that their shared session logs contained exposed secrets.
Injection schemes exploiting in- and cross-session compatibility (Image Source: Arxiv.org)
Furthermore, the vulnerability enables invisible indirect prompt injection attacks against autonomous AI agents. An adversary can craft malicious instructions inside an encrypted reasoning block.
When processed by an agent, monitoring tools inspecting only the visible conversation history fail to flag the hidden payload, allowing the injected instructions to compromise downstream agentic workflows undetected.
ProviderOriginating Flagship ModelTarget Decryption OracleExtracted Asset / RiskAnthropicClaude Opus 4.8 / Sonnet 5Claude Haiku 4.5Unaligned chain-of-thought, system prompts, API keysOpenAIGPT-5.6 / GPT-5GPT-5-mini / o4-miniInternal safety evaluation, credentials, raw reasoningGoogleGemini 3 / Gemini 3.1 ProGemini 3.1 Flash Lite / FlashHardcoded secrets, hidden instructions, PII
Following responsible disclosure, OpenAI, Anthropic, and Google acknowledged the research findings. All three vendors deployed server-side mitigations, rendering the original cross-model replay PoCs non-reproducible on current API builds.
To establish comprehensive Generative AI security controls across LLM pipelines, providers and enterprise developers should implement the following protections:
Cryptographic Binding: Bind reasoning envelopes to the specific originating model, session ID, and user identity at the API gateway layer.
Strict Model Isolation: Reject thinking blocks submitted to a different model tier than the one that generated the payload.
Key Rotation: Rotate legacy signing keys to invalidate historical ciphertext blocks exposed in public code repositories.
Log Sanitization: Developer teams building AI agents must treat encrypted thinking blocks as sensitive data and scrub raw signature fields before making agent logs public.
[Live Webinar] Join Elastic & UnderDefense to learn how small security teams can unify AI visibility and agentic response into one operating model -> Register Now
The post OpenAI, Anthropic, and Google LLM APIs vulnerability Exposes Hidden Reasoning Traces appeared first on Cyber Security News.
