Researchers Extract Secrets by Replaying Encrypted AI Reasoning Blocks
Summary
Researchers replayed encrypted reasoning blocks across sessions and compatible models, decoding secrets from public agent logs and demonstrating hidden prompt injection. They say mitigations stopped tested attacks; vendors have not confirmed this. No in-the-wild attack
Key points
- Researchers found encrypted reasoning blocks from OpenAI, Anthropic, and Google APIs could be replayed across sessions and processed by compatible models without cracking the encryption.
- Across 6,708 public agent trajectories, researchers decoded 315,320 reasoning blocks and reported 704 distinct privacy artifacts from genuine user sessions, including API keys, passwords, access tokens, and private keys.
- The cross-user extraction required an intact reasoning block, such as one published in an agent log, and API access to a compatible model; it did not provide arbitrary access to private chats.
- Researchers demonstrated that opaque reasoning blocks could conceal prompt injections, including a proof of concept that caused a receiving model to add an attacker-directed upload action.
- The authors say mitigations stopped the demonstrated attacks, and their statement says the main extraction attack was no longer reproducible as of August 2026; the article reports no vendor confirmation or malicious in-the-wild exploitation.
- The researchers could not verify every reconstructed trace against ground-truth plaintext, and the article says it remains unclear whether previously published blocks are still decodable.
- Developers are advised to remove reasoning blocks and opaque reasoning fields from shared traces and avoid committing raw API transcripts, even when visible text has been sanitized.
Article Details
- Attack Vectors
- Replay an intact encrypted reasoning block from one session or user in another session, using API access to a compatible model from the same provider.
- Replay a published agent-log reasoning block to a weaker compatible model and prompt it to transcribe hidden reasoning, which researchers used to recover secrets from some public traces.
- Embed a malicious instruction in an opaque reasoning block and replay it into an unrelated task; the proof of concept caused the receiving model to add an attacker-directed upload action without showing the instruction in visible text.
- Defensive Notes
- Strip reasoning blocks and opaque reasoning fields before sharing agent traces.
- Avoid committing raw API transcripts, even when visible conversation text has been sanitized.
- When switching models, strip thinking blocks where provider guidance calls for it; the article says Anthropic advises this because other models ignore those blocks.
- The researchers reported that the demonstrated attacks stopped working after mitigations, but the article notes this is based on their reproducibility statement rather than vendor confirmation.
People
Vendors
AnthropicA newly disclosed flaw in OpenAI, Anthropic, and Google reasoning APIs let researchers replay encrypted reasoning objects across sessions and recover hidden content from public logs, including API keys and passwords.GoogleA newly disclosed flaw in OpenAI, Anthropic, and Google reasoning APIs let researchers replay encrypted reasoning objects across sessions and recover hidden content from public logs, including API keys and passwords.OpenAIA newly disclosed flaw in OpenAI, Anthropic, and Google reasoning APIs let researchers replay encrypted reasoning objects across sessions and recover hidden content from public logs, including API keys and passwords.
Products
ChatGPT: GPT-5.6 Lunamodel to act as what the authors call a “fuzzy” decoder: Claude Haiku 4.5 for Claude traces, GPT-5.6 Luna for GPT traces, and Gemini Robotics ER-1.6 for Gemini traces.Claude Haiku 4.5and models, allowing a weaker compatible model to act as what the authors call a “fuzzy” decoder: Claude Haiku 4.5 for Claude traces, GPT-5.6 Luna for GPT traces, and Gemini Robotics ER-1.6 for Gemini traces.Gemini Robotics ER-1.6call a “fuzzy” decoder: Claude Haiku 4.5 for Claude traces, GPT-5.6 Luna for GPT traces, and Gemini Robotics ER-1.6 for Gemini traces.