Full Report
A newly disclosed flaw in the way OpenAI, Anthropic, and Google carried hidden AI reasoning between API calls let researchers recover internal reasoning and secrets from session logs, including API keys and passwords. The weakness affected encrypted reasoning objects used by the providers' reasoning APIs, where a block created in one session could be replayed into another and, during testing,
Analysis Summary
# Vulnerability: Opaque Reasoning Replay and Secret Extraction in LLM APIs
## CVE Details
- **CVE ID:** Not yet assigned (Disclosed August 2026)
- **CVSS Score:** N/A (High Severity indicated by impact)
- **CWE:** CWE-940 (Improper Verification of Source or Authenticity), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
## Affected Systems
- **Products:** AI Model APIs utilizing "Reasoning" or "Thinking" blocks.
- **Vendors:** OpenAI, Anthropic, Google, Microsoft, and Hugging Face.
- **Affected Models (during testing):**
- OpenAI: GPT-5.6 Luna and compatible models.
- Anthropic: Claude 4.5 Haiku and compatible models.
- Google: Gemini Robotics ER-1.6 and compatible models.
- **Configurations:** Systems where application developers manage conversation state manually or statelessly, replaying encrypted reasoning objects/signatures in session logs.
## Vulnerability Description
The flaw stems from the design of "encrypted reasoning objects" used to maintain state across API calls without exposing internal AI "thinking" to the user. Researchers discovered that these opaque blocks were portable across different sessions, users, and models within the same provider family.
By obtaining an encrypted reasoning block (e.g., from a published agent log), an attacker can replay that block into a session with a "weaker" model. The weaker model can then be prompted to act as a "fuzzy decoder," transcribing the internal reasoning and secrets (API keys, passwords) contained within the supposedly secure encrypted block.
## Exploitation
- **Status:** PoC available (Main extraction attack mitigated as of August 2026).
- **Complexity:** Medium (Requires access to a published encrypted reasoning block and API access).
- **Attack Vector:** Network (API-based replay).
## Impact
- **Confidentiality:** **High** (Recovery of 704 privacy artifacts including 62 API keys, 33 passwords, and 24 access tokens).
- **Integrity:** **High** (Enables "invisible" prompt injections where malicious instructions are hidden inside opaque blocks).
- **Availability:** **Low** (No direct impact on system uptime).
## Remediation
### Patches
- **Vendor Mitigations:** Major providers (OpenAI, Anthropic, Google) implemented backend changes in August 2026 to prevent cross-user and cross-model replay of reasoning blocks.
- **Updated Handling:** Vendors have modified how thought signatures and reasoning items are validated to ensure they are session-bound.
### Workarounds
- **Data Sanitization:** Developers must strip all "opaque reasoning fields" and "reasoning blocks" from application logs before publishing or sharing them.
- **Transcript Security:** Avoid committing raw API transcripts to public repositories or logs, even if the visible text has been sanitized.
## Detection
- **Indicators of Compromise:**
- Unusually high volumes of reasoning-token calls from "weaker" models (e.g., Haiku or Luna) attempting to process reasoning objects from "stronger" models.
- Presence of reasoning objects in publicly accessible developer logs or GitHub repositories.
- **Detection Methods:** Audit CI/CD pipelines and logging systems for the storage of `reasoning_content` or `thought_signature` fields.
## References
- **Research Paper:** hxxps[://]arxiv[.]org/abs/2608.09867
- **Vendor Documentation:**
- OpenAI API Guides: hxxps[://]developers[.]openai[.]com/api/docs/guides/latest-model
- Google Gemini Thought Signatures: hxxps[://]ai[.]google[.]dev/gemini-api/docs/thought-signatures
- **Source Article:** hxxps[://]thehackernews[.]com/2026/08/openai-anthropic-google-api-flaw-let.html