AI Reasoning Blobs Leaked API Keys Across Three Providers
3 min readResearchers have shown that the encrypted “thinking” blocks OpenAI, Anthropic and Google pass between API calls could be lifted from public logs, replayed by a different account, and decoded. Inside them they found API keys, passwords and access tokens that never appeared in the visible conversation.
What the reasoning blocks were for
Reasoning models do a lot of work the user never sees. When an application manages its own conversation history instead of letting the provider store it, that hidden reasoning has to travel with each request or the model loses its train of thought. All three vendors solved it the same way. OpenAI returns encrypted reasoning items, Anthropic wraps the reasoning in an encrypted signature, and Google uses encrypted thought signatures. Because the plaintext is never exposed to the client, developers widely treated these blobs as opaque and safe to paste into logs and repositories.
What the researchers found
A paper titled Stealing Reasoning Traces from Proprietary LLM APIs, covered by The Hacker News, shows the encryption was never the weak point. The team never cracked a key. They found the blocks were portable: an object created in one session could be replayed into a different session, a different user, or a different model in the same family. A weaker sibling model then acted as what the authors call a fuzzy decoder and transcribed what the stronger model had been thinking. Claude Haiku 4.5 decoded Claude traces, GPT-5.6 Luna decoded GPT traces, and Gemini Robotics ER-1.6 decoded Gemini traces.
The scale is the uncomfortable part. Across 6,708 public agent trajectories the team decoded 315,320 thinking blocks. After excluding benchmark data, 704 distinct privacy artifacts came from genuine user sessions, including 62 API keys, 33 passwords, 24 access tokens and seven private keys. Sixty-four of those secrets existed only inside hidden reasoning and nowhere in the readable transcript. The same portability enabled a second trick: the researchers hid a malicious instruction inside an opaque block and replayed it into an unrelated task, causing the receiving model to perform an attacker-directed upload with nothing suspicious in the visible text.
Why it matters
Scrubbing the readable part of an agent log is no longer enough. Anyone who published raw API transcripts with reasoning objects intact may have shipped credentials they thought were encrypted. The researchers disclosed to the three providers plus Microsoft and Hugging Face, and say the main extraction attack stopped working after mitigations. That claim rests on their own reproducibility statement: none of the vendors has publicly confirmed the flaw. Anthropic’s documentation now says thinking blocks belong to the model that produced them and should be stripped when switching models. One question stays open. Hundreds of thousands of blocks are already sitting in public repositories, and whether those remain decodable is a separate matter from whether fresh attacks succeed.
If you build with reasoning APIs, strip the opaque fields before sharing anything. The safest assumption is that an encrypted blob is not the same thing as a private one.