Recent research has uncovered a significant security flaw affecting major AI providers, including OpenAI, Anthropic, and Google. This vulnerability allows attackers to extract the internal ‘chain-of-thought’ reasoning from large language models (LLMs) by exploiting weaknesses in their API implementations.
LLMs like GPT-5.6, Claude Opus 4.8, and Gemini 3 generate internal reasoning traces during processing. These traces, containing sensitive information such as intellectual property and safety checks, are typically encrypted and transmitted as base64-encoded envelopes. Client applications use these envelopes to maintain conversational context without storing state on the server.
The flaw lies in the encryption process. Researchers discovered that these encrypted payloads are authenticated using a global key shared across the provider’s infrastructure, rather than being tied to specific user accounts, session IDs, or model tiers. This oversight allows an encrypted reasoning envelope from a heavily guarded model to be replayed into a less secure, sibling model within the same provider’s ecosystem.
By injecting the encrypted reasoning block from a flagship model into the API call of a smaller, less protected model, attackers can prompt the smaller model to output the internal reasoning in plain text. This method effectively uses the less secure model as a decryption oracle, exposing sensitive internal processes.
The implications of this vulnerability are far-reaching. Analysis of over 6,700 public agent transcripts revealed the recovery of more than 315,000 embedded reasoning blocks, which included:
- 367 instances of Personally Identifiable Information (PII)
- 182 hardcoded credentials, comprising 62 API keys, 33 passwords, and 30 personal email addresses
Notably, much of this sensitive data was present only within the internal reasoning blocks and was not visible in the assistant’s responses, leaving developers unaware of the exposure.
Furthermore, this vulnerability facilitates indirect prompt injection attacks against autonomous AI agents. Malicious instructions can be embedded within an encrypted reasoning block. When processed by an agent, these hidden instructions can compromise downstream workflows without detection, as monitoring tools typically inspect only visible conversation history.
This discovery underscores the critical need for AI providers to implement robust encryption practices and ensure that internal reasoning traces are securely managed. As AI systems become increasingly integrated into various applications, safeguarding their internal processes against such vulnerabilities is paramount to maintaining trust and security in AI-driven solutions.
