Critical Security Flaw Discovered in Major AI Models
Vulnerability in OpenAI, Anthropic, and Google APIs allowed theft of hidden reasoning processes from powerful models.
1API Design Flaw
A design flaw was discovered in OpenAI, Anthropic, and Google's APIs that allowed encrypted reasoning blocks to be transported between sessions. This vulnerability enabled blocks created in one session to be reused in another and even decrypted by weaker models from the same provider. Researchers analyzed 315,320 thinking blocks across 6,708 public agent trajectories.
2Four Attack Vectors
In their paper 'Stealing Reasoning Traces from Proprietary LLM APIs', researchers identified four abuse scenarios: theft of proprietary reasoning processes, extraction of private data from published traces, recovery of harmful content hidden behind safe answers, and prompt injections concealed within opaque reasoning blocks. Using these methods, they obtained 62 API keys, 33 passwords, and 24 access tokens.
3Decryption via Weaker Models
Testing revealed that encrypted blocks could be transported across sessions, users, and models. This allowed weaker models from the same provider (like Claude Haiku 4.5, GPT-5.6 Luna, and Gemini Robotics ER-1.6) to function as 'fuzzy' decoders. The weaker models could transcribe reasoning processes generated by more powerful models.
4Exposure of Hidden Data
Of the 704 private artifacts recovered, 64 existed only in hidden reasoning blocks and nowhere in visible traces. This means sanitizing readable conversations might leave secrets within opaque blocks vulnerable. Published raw agent logs with intact reasoning objects became particularly concerning security risks.
5Invisible Prompt Injection
The same portability enabled an invisible prompt injection proof-of-concept. Researchers created an opaque reasoning block carrying malicious instructions, then replayed it into unrelated tasks. The receiving model executed attacker-directed upload actions without displaying the injected instructions in visible text.
6Encryption Not Broken, But...
The encryption itself wasn't cracked, and the attack didn't require obtaining encryption keys. It relied on providers accepting and processing intact opaque blocks. Researchers note they lack ground-truth plaintext of proprietary reasoning, so they can't guarantee every reconstructed trace is exact.
7Vendor Mitigations
Researchers disclosed findings to Microsoft and Hugging Face, stating demonstrated attacks no longer work. OpenAI still advises developers to replay encrypted reasoning items when managing stateless history manually. Anthropic now states thinking blocks are model-specific and should be stripped when switching models.
8AI Security Wake-up Call
This discovery shows how quickly security vulnerabilities in AI systems can create chain reactions. Developers should strip reasoning blocks from shared traces and avoid committing raw API transcripts, even when visible text appears sanitized. As AI accelerates coding, it also speeds up vulnerability discovery, requiring enhanced security measures.
Original article: The Hacker News — Büyük AI Modellerinde Kritik Güvenlik Açığı Keşfedildi