Bottom line: A research paper shows that encrypted reasoning blocks from OpenAI, Anthropic and Google models could be extracted from shared agent transcripts, exposing over 700 sensitive findings such as API keys and passwords, some of which appeared only in the hidden reasoning block and not in the visible chat history.
A research paper published on August 12 describes how the encrypted reasoning steps of large AI models could be reused across sessions, users, and even different model versions, and read out in plaintext. Models from OpenAI, Anthropic, and Google were affected.
The researchers exploited the fact that a weaker model from the same provider family could be induced to output the actually hidden reasoning content of a stronger model as plaintext. Examples include Claude Haiku 4.5 for Claude content or GPT-5.6 Luna for GPT content. From 6,708 publicly accessible agent transcripts, they decoded a total of 315,320 such encrypted reasoning blocks. After excluding pure benchmark sources, 704 distinct, sensitive findings from real user sessions remained: 62 API keys, 33 passwords, 24 access tokens, and seven private keys.
In 64 of these findings, the sensitive data appeared exclusively in the hidden reasoning block, not in the visible conversation history. Simply sanitizing the visible text before publishing transcripts would therefore not have been sufficient to protect credentials in these cases. The encryption used itself was not broken: the attackers did not need a cryptographic key, but merely exploited the fact that the opaque reasoning blocks were accepted and further processed unchanged by the providers’ APIs.
For CISOs, this results in a concrete action item for all teams that share agent transcripts, debugging logs, or API recordings of LLM interactions internally or publish them externally, for example for bug bounty purposes, support cases, or research collaborations. Reasoning blocks are not merely a display artifact but can, independently of the visible text, contain sensitive content such as credentials that would be overlooked by mere text redaction of the chat history.
The researchers reported their findings to the affected providers. The central extraction attack is said to no longer work following the countermeasures subsequently implemented, though no public confirmation from OpenAI, Anthropic, or Google was available at the time of publication. It also remains unclear whether older reasoning blocks already publicly accessible can still be read out. No evidence of actual exploitation outside the research work was found. Developers and security teams are advised to consistently remove reasoning blocks from shared transcripts and not to publish raw API recordings, even if the visible conversation text has already been sanitized.
Source: www.it-daily.net · Published August 16, 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.