The flaw affecting OpenAI, Anthropic, and Google isn’t about crypto. It’s a design choice: vendors encrypt reasoning blocks but make them replayable, letting attackers feed them into weaker models to force decryption.
Researchers analyzed 315,320 reasoning traces and extracted 704 privacy artifacts, including 62 real API keys. The vulnerability has four attack vectors: bypassing anti-distillation, extracting user data, exposing harmful content, and hiding prompt injections. Server-side mitigations deployed, but the exposure already happened.
The design is fundamentally flawed. Vendors must pass reasoning objects to clients. Once they leave the server, they become replayable artifacts. Responsible disclosure likely prevented wider harm, but the full exposure scope remains unknown.
Sources: Stealing Reasoning Traces from Proprietary LLM APIs
*Coverage: OpenAI, Anthropic, Google API Flaw Let Weaker AI Models Decode Stronger Models’ Reasoning • Encrypted reasoning cracked across Anthropic, OpenAI, Google
Related on this blog: Google Signed the Open Weights Letter, and Anthropic Is Now Alone • [AUTO] AI-Generated Patches Fail at Scale • [AUTO] Langflow RCE Added to KEV After a Month of Silence