Stealing AI Reasoning Traces
AI companies like OpenAI, Google, and Anthropic encrypt their models' internal reasoning steps to hide trade secrets. But these encrypted blocks can be swapped between different AI models, letting attackers trick weaker models into revealing the original reasoning in plain text.
- Report priority
- Medium
How it works
- AI companies encrypt their models' internal reasoning steps to hide trade secrets.
- But these encrypted blocks are designed to work across different AI models and users.
- Attackers can take an encrypted reasoning block from a powerful model and inject it into a weaker model.
- The weaker model then decodes and outputs the original reasoning in plain text, bypassing the stronger model's protections.
- This works because the encryption is not tied to a specific model or user session.
What to do
If you use or develop with AI APIs from Anthropic, OpenAI, or Google and rely on your encrypted reasoning traces, check if your API requests include these encrypted blocks, most do if you're debugging or testing. If you're a developer, review your session logs for leaked reasoning data, as attackers can scrape and decode these blocks from public sources.
Monitor official announcements from Anthropic, OpenAI, and Google for updates on patches or mitigations. In the meantime, avoid sharing session logs publicly and assume encrypted reasoning blocks may be extractable. If you're a developer, consider using alternative debugging methods that don't expose these blocks.
Technical details
A newly disclosed vulnerability (NEWS-2cd4f2783638ddcb84) exploits how leading AI providers like Anthropic, OpenAI, and Google encrypt proprietary reasoning traces, step-by-step internal logic used by large language models, to prevent intellectual property leakage. Instead of storing these traces server-side, providers return them to clients as reusable encrypted blocks. Researchers found these blocks are cross-compatible across sessions, users, and models within the same provider, allowing them to bypass security safeguards.
By injecting an encrypted trace from a high-capability model into a weaker, less-secure model, attackers force the weaker model to decode and leak the original trace in plaintext without directly compromising the stronger model. The flaw enables four attack vectors: extracting proprietary reasoning logic, harvesting private data from public session logs (recovering 367 PII artifacts and 182 credentials from 315,320 scraped blocks), exposing hidden hazardous information in model reasoning, and embedding invisible prompt injections within encrypted blocks to corrupt public AI agent deployments. Responsible disclosure has been made, and mitigations focusing on cryptographic and system-level hardening are proposed.