Researchers Extract Hidden AI Reasoning and Secrets from Encrypted API Traces
Summary
Researchers found that compatible AI models could expose reasoning from encrypted API blocks, recovering credentials and personal information from public traces and demonstrating that replayed blocks could carry malicious instructions.
Key points
- Encrypted reasoning blocks could be replayed across users, conversations, and compatible models from the same provider; weaker models could be prompted to reveal the reasoning.
- Researchers decoded 315,320 reasoning blocks from 6,708 publicly available agent trajectories.
- The collected traces contained 367 personal-information artifacts and 182 credentials; genuine user sessions yielded more than 60 API keys and 33 passwords.
- Some recovered secrets were absent from visible conversation histories, including cases where visible text had been sanitized.
- A proof of concept showed that a replayed reasoning block could cause a model to generate a script that uploaded a presentation to an attacker-controlled server.
- Researchers proposed binding reasoning state to both the user and session to prevent it from being replayed in unrelated contexts.
Article Details
- Attack Vectors
- Replay encrypted reasoning blocks across conversations, users, or compatible models from the same provider, then prompt a weaker model to disclose the reasoning available in its context.
- Embed malicious instructions in a reasoning block and replay it into a model; the article reports a proof of concept in which a generated script also uploaded a presentation to an attacker-controlled server.
- Defensive Notes
- Bind reasoning state to the user and session so it cannot be replayed across unrelated contexts; the article describes a context-bound construction using user_id and session_id.
- Assess which identities, sessions, and models can submit ciphertext, and which systems can consume the resulting plaintext.
Products
Claude HaikuSo you take the exact block and put it into a weaker model like Claude Haiku. Now, Haiku does not know the encryption string, and neither do you.Claude OpusImagine Claude Opus does some complicated reasoning. You ask it a hard question, and it gets to work. The API doesn’t give you the plaintext reasoning, it gives you the encrypted reasoning block.Gemini Robotics 1.6The researchers specifically selected the weakest compatible decoder they could find for each provider. Haiku 4.5 was used for Claude, GPT-5.6 Luna for GPT models, and Gemini Robotics 1.6 for Gemini.GPT-5.6 LunaThe researchers specifically selected the weakest compatible decoder they could find for each provider. Haiku 4.5 was used for Claude, GPT-5.6 Luna for GPT models, and Gemini Robotics 1.6 for Gemini.GPT-5.6 Solreasoning containing an instruction about uploading PowerPoint files, transferred that reasoning into GPT-5.6 Sol, then asked it for an unrelated script to edit a presentation, and the resulting script also uploadedHaiku 4.5The researchers specifically selected the weakest compatible decoder they could find for each provider. Haiku 4.5 was used for Claude, GPT-5.6 Luna for GPT models, and Gemini Robotics 1.6 for Gemini.