Researchers Expose Cross-Session LLM Reasoning Trace Flaw
Researchers published a preprint on August 10 reporting that encrypted reasoning-trace blocks used by OpenAI, Anthropic, and Google APIs can be replayed across sessions, users, and models within a provider's ecosystem. The authors say attackers can inject a stronger model's block into a weaker sibling model and obtain the underlying trace in plaintext. They also reported recovering 367 PII artifacts and 182 credentials from 315,320 publicly available blocks.
Researchers have reported an architectural flaw affecting encrypted reasoning-trace blocks returned by APIs from OpenAI, Anthropic, and Google. In the August 10 preprint, "Stealing Reasoning Traces from Proprietary LLM APIs," the authors write that these blocks can be replayed across different sessions, users, and models within a single provider's ecosystem.
According to the paper's abstract, the attack does not require jailbreaking the stronger model whose trace is being extracted. Instead, an attacker can take an encrypted block generated by a more capable model, submit it to a weaker and less safeguarded model from the same provider, and induce that model to decode and output the trace as plaintext.
How the reported attack works
The researchers describe a client-side design in which providers return encrypted reasoning blocks to customers, which are then passed back in subsequent API requests rather than retained solely on the provider's servers. The paper argues that the blocks' compatibility across users, sessions, and models creates a replay and substitution path.
The proposed attack relies on two conditions reported by the authors:
- •A reasoning block created by one model can be accepted by another model in the same provider ecosystem.
- •A weaker model can be prompted to decode and expose the block's plaintext content.
- •The stronger model does not need to receive the adversarial prompt directly.
The researchers characterize this as a cross-model extraction technique that bypasses protections intended to limit model distillation and prevent disclosure of hidden reasoning content. The paper reports demonstrations across Anthropic, OpenAI, and Google APIs.
Public logs create a data-exposure path
Beyond proprietary reasoning, the preprint reports a large-scale scan of publicly available repositories containing session data. The authors state that they decoded 315,320 reasoning blocks, recovering 367 personally identifiable information artifacts and 182 credentials.
Those figures are author-reported findings from a preprint and should not be read as an independent estimate of the total data exposed across provider ecosystems. The supplied source material does not include public responses from OpenAI, Anthropic, or Google addressing the paper's technical findings.
The paper also identifies two additional risks: exposure of hazardous content that may appear inside a model's hidden reasoning even when its visible answer refuses a request, and prompt-injection payloads embedded in encrypted blocks that could contaminate agentic workflows. The authors write that they disclosed the issue responsibly and propose cryptographic and system-level mitigations.
Implications for API and agent builders
For teams using reasoning-enabled APIs, the finding shifts attention from visible model output to the lifecycle of opaque metadata returned by an API. Organizations that publish debugging logs, evaluation traces, or agent transcripts may inadvertently expose data that is not legible at the time of publication but could become decodable through a related model endpoint.
Comparable distributed-system security failures commonly arise when a token or ciphertext is accepted outside its intended context. Standard defenses in such settings include binding encrypted artifacts to a specific user, session, model, request, and expiry period, then rejecting replayed artifacts that fail those checks. The paper's findings make provenance controls, log redaction, secret scanning, and access boundaries relevant not only for prompts and outputs, but also for provider-generated reasoning blocks.
The report also raises a broader evaluation question for practitioners: a hidden chain-of-thought field is not necessarily isolated merely because it is encrypted or omitted from a standard response. Security review needs to test whether opaque API artifacts can be copied between accounts, models, sessions, and downstream agents, particularly where logs are stored or shared externally.
Key Points
- 1A preprint reports that reasoning blocks can cross user, session, and model boundaries, undermining assumptions that encrypted API metadata is isolated.
- 2Researchers reported 367 PII artifacts and 182 credentials recovered from public session data, making logging practices a direct security concern.
- 3Comparable token-replay failures are typically reduced through strict contextual binding, expiration, provenance validation, and redaction of opaque API artifacts.
Scoring Rationale
The preprint reports a potentially broad reasoning-trace and data-extraction flaw across three major frontier-model API ecosystems. It is highly relevant to teams building agents, storing API transcripts, or relying on hidden reasoning metadata, although the reported findings and scope remain based on the authors' preprint.
Sources
Primary source and supporting public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems