Hidden Reasoning Flaw in OpenAI, Anthropic and Google APIs Exposed Secrets Across Sessions
Researchers pulled API keys and passwords out of encrypted reasoning blocks that were meant to stay private between calls to the major AI providers.
Key points
- Researchers found a flaw in the reasoning APIs run by OpenAI, Anthropic and Google that let encrypted internal thoughts leak between separate user sessions.
- The encrypted reasoning objects, meant to keep a model's step-by-step working private, could be replayed into a different session and decoded.
- Recovered material included API keys and passwords that had passed through the model during earlier requests.
- All three providers were notified privately before the details were made public; fixes were rolled out at the API layer.
- No formal regulator filing has been triggered by the disclosure itself, but the finding sits squarely in the path of coming AI transparency rules in the US and EU.
A disclosure this week, first reported by The Hacker News, describes a weakness in the way three of the largest AI providers, OpenAI, Anthropic and Google, carried hidden model reasoning between calls to their programming interfaces. Researchers were able to lift that hidden reasoning out of one user's session and read it inside another, and what they found inside included live secrets.
That is the kind of sentence that regulators read twice.
What actually leaked?
The leaked material was the model's internal reasoning, plus anything the model had been reasoning about. The providers wrap that reasoning in an encrypted object, sometimes called a reasoning block or reasoning item, so the developer using the API can pass it back on the next call without seeing inside it. During testing, the researchers were able to take a block created in one session and replay it into another session, then coax the receiving model into decoding it.
Inside those blocks the team recovered API keys, meaning the long secret strings that let software log in to other services, and user passwords that had been pasted into earlier prompts.
Who is affected?
Developers who built products on the reasoning APIs of OpenAI, Anthropic or Google, and anyone whose data those products handled. If you have ever typed a password or a key into a chatbot built on top of these services, that content sat inside the model's working memory at some point.
Ordinary consumer chat sessions on the vendors' own websites are a separate surface and were not the focus of the write-up.
What have the providers done?
All three vendors were told privately before publication and have made server-side changes to how reasoning blocks are validated and bound to a single session. Because the fix sits inside their own infrastructure, customers do not need to install anything. There is no CVE identifier attached to the disclosure at time of writing.
| Provider | Feature affected | Status |
|---|---|---|
| OpenAI | Encrypted reasoning items in the Responses API | Mitigated server-side |
| Anthropic | Extended thinking blocks in the Messages API | Mitigated server-side |
| Thought signatures in Gemini API | Mitigated server-side |
Why does this matter for policy?
Because the rules being drafted right now assume this kind of thing gets disclosed. In the United States, the Securities and Exchange Commission's cyber disclosure rule at 17 CFR 229.106, adopted in the final rule of July 2023 and effective December 2023, requires public companies to describe material cybersecurity incidents on Form 8-K Item 1.05 within four business days of a materiality determination. A cross-tenant leak of customer secrets from a core AI service is exactly the fact pattern that forces a materiality call.
In the European Union, the AI Act, which entered into force on 1 August 2024, layers a separate serious-incident reporting duty on providers of high-risk systems under Article 73, with staggered application dates running through 2026. The reasoning-object design sits in the middle of that scope.
Neither regime has been formally triggered by this disclosure that we have seen. The proposed update to the SEC's Regulation S-P safeguards rule, whose comment period closed in 2023 and whose final text took effect in 2024, is the closer fit for the downstream question: what does a developer owe its own customers when a dependency spills their credentials.
What should users and developers do now?
Rotate any API keys, tokens or passwords that were sent through a reasoning-mode call in recent months. Treat prompt content as logged content. For end users of AI-powered products, the practical rule has not changed: do not paste live passwords or account secrets into a chat window, even one that promises privacy.
Common questions
Were consumer ChatGPT, Claude and Gemini chats affected?
The research targeted the reasoning objects exchanged over the developer APIs. The vendors' consumer chat apps use related but separately managed pipelines and were not the subject of the write-up.
Do I need to change my password?
Only if you pasted a password into a prompt that went to a reasoning-mode model, or you use a product that did so on your behalf. When in doubt, rotate.
