AI chatbots leak internal secrets via API trick

Published August 11, 2026

OpenAI, Google, and Anthropic's chatbots secretly send encrypted internal notes between conversations. Attackers can trick them into revealing those notes, exposing trade secrets and safety checks.

Report priority
High
Targets
OpenAI+5 more

How it works

Attackers replay encrypted internal notes from one chatbot conversation into another to trick it into revealing its hidden reasoning, like showing a doctor's notes to a nurse and getting the real diagnosis.

What to do

Check if you use OpenAI, Anthropic, or Google's API to chat with Claude, GPT, or Gemini, this applies to developers and companies building apps on top of these services.

Update your API code to validate encrypted payloads per the vendor's latest security guidance, as no patch for the chatbot side is yet available.

Technical details

Affected software: OpenAI, Anthropic, Google, Claude, GPT, Gemini

An attacker sends a fake chatbot request to Claude, embedding an encrypted note from a previous GPT conversation. Claude, not knowing it's fake, replies with its own internal notes, including safety checks and trade secrets, because it trusts the encrypted format. The attacker now has those secrets to study or sell.

A critical flaw in the API security of major AI providers, including OpenAI, Anthropic, and Google, allows attackers to extract internal "chain-of-thought" reasoning traces from flagship models like GPT-5.6, Claude Opus 4.8, and Gemini 3. These traces, which contain proprietary logic and safety checks, are normally encrypted and sent to clients as base64-encoded envelopes for multi-turn conversations. However, the encryption uses a single provider-wide key instead of per-user or model-specific binding, letting attackers replay these envelopes into weaker sibling models (e.g., outdated Claude Haiku versions) to force them to decrypt and leak the plaintext reasoning.

The attack requires only standard API access and exploits lightweight models as "decryption oracles," instructing them to transcribe the internal logic via custom prompts. Researchers from ELLIS Institute Tübingen, Max Planck Institute, MATS Research, and Snyk demonstrated this on Claude, GPT, and Gemini ecosystems. No CVE or CVSS score was assigned.

References

View Original Source