Researchers have discovered a critical flaw in how OpenAI, Anthropic, and Google handle encrypted reasoning objects passed between API calls. The vulnerability allows attackers to extract hidden AI model reasoning, API keys, passwords, and other secrets directly from session logs.
The flaw centers on the reasoning APIs these three companies provide. When advanced AI models process complex queries, they generate internal reasoning chains stored in encrypted objects. These objects travel between API calls during user sessions. The researchers found that these encrypted reasoning blocks lack proper session binding. A reasoning object created in one session can be replayed into a completely different session, allowing an attacker with access to logs to recover the original reasoning data.
During testing, the researchers successfully extracted multiple types of sensitive information from these reasoning objects. API keys emerged from session logs. Passwords stored in user prompts appeared in decrypted reasoning chains. Internal model instructions and reasoning steps became visible. The scope extends beyond basic credentials. Any data the model processes while reasoning internally can potentially be exposed through this attack vector.
The vulnerability affects the core reasoning APIs from all three providers. OpenAI's o1 and o3 models depend on these reasoning mechanisms. Anthropic's extended thinking functionality relies on similar encrypted objects. Google's reasoning-capable models use comparable infrastructure. Each implementation shared the same fundamental weakness: reasoning objects were not cryptographically bound to specific user sessions.
The attack requires access to session logs or network traffic, but this represents a realistic threat for cloud environments. An attacker with compromised infrastructure, malicious insider access, or network visibility could systematically collect and replay reasoning objects. Once replayed into a controlled session, the encrypted blocks decrypt using the API's session key, exposing the reasoning data inside.
The implications affect both enterprise and individual users. Organizations using these APIs for sensitive work face exposure of proprietary data processed during model reasoning. Individuals using these services risk credential leakage if those credentials appear in prompts or system instructions. The reasoning objects contain unfiltered model outputs that often include sensitive information from the original queries.
OpenAI, Anthropic, and Google each received disclosure of these findings before public release. The companies face pressure to implement session binding mechanisms that cryptographically tie reasoning objects to specific user sessions. Without this binding, replayed objects should fail to decrypt outside their original context. Implementing stateless verification of session ownership becomes critical.
The timing of this disclosure highlights a broader pattern in AI API security. As these companies expand reasoning capabilities and offer more sophisticated APIs, the encrypted objects carrying internal model state become attractive attack targets. The researchers demonstrated that encryption alone provides insufficient protection when the underlying protocol permits replay attacks.
Organizations currently using these reasoning APIs should review their session management practices and consider restricting which accounts can access reasoning objects. API key rotation becomes urgent if users transmitted credentials during reasoning-enabled sessions. Waiting for provider patches remains necessary, but immediate access reviews reduce exposure risk.
The vulnerability underscores the importance of treating AI reasoning objects as high-value targets containing the same protections afforded to encryption keys and session tokens. Reasoning chains reveal model behavior, user data, and operational details that adversaries specifically seek.