Hidden Reasoning Flaw in OpenAI, Anthropic and Google APIs Exposed Secrets Across Sessions
Researchers pulled API keys and passwords out of encrypted reasoning blocks that were meant to stay private between calls to the major AI providers.
Key points
- Researchers found a flaw in the reasoning APIs run by OpenAI and Anthropic and Google that let encrypted internal thoughts leak between separate user sessions.
- The encrypted reasoning objects, meant to keep a model's step-by-step working private, could be replayed into a different session and decoded.
- Recovered material included API keys and passwords that had passed through the model during earlier requests.
- All three providers were notified privately before the details were made public; fixes were rolled out at the API layer.
- No formal regulator filing has been triggered by the disclosure itself, but the finding sits squarely in the path of coming AI transparency rules in the US and EU.
A disclosure this week, first reported by The Hacker News, describes a weakness in the way OpenAI, Anthropic and Google carried hidden model reasoning between calls to their programming interfaces. Researchers lifted that reasoning out of one user's session and read it inside another. What they found there included live secrets.
That's the kind of sentence regulators read twice.
What actually leaked?
Each provider wraps a model's internal reasoning in an encrypted object, sometimes called a reasoning block or reasoning item, so a developer can pass it back on the next call without seeing inside it. During testing, the researchers took a block created in one session, replayed it into a different session entirely, then coaxed the receiving model into decoding the contents.
Inside those blocks the team recovered API keys, meaning the long secret strings that let software authenticate to other services, alongside user passwords that had been pasted into earlier prompts.
Who is affected?
Developers who built products on the reasoning APIs of these three providers, and anyone whose data those products handled. If you've ever typed a password or key into a chatbot built on top of these services, that content sat inside the model's working memory at some point.
Ordinary consumer chat sessions on the vendors' own websites are a separate surface and weren't the focus of the write-up.
What have the providers done?
All three were told privately before publication and have made server-side changes to how reasoning blocks are validated and bound to a single session. Because the fix sits inside their own infrastructure, customers don't need to install anything. No CVE identifier was attached to the disclosure at time of writing.
| Provider | Feature affected | Status |
|---|---|---|
| OpenAI | Encrypted reasoning items in the Responses API | Mitigated server-side |
| Anthropic | Extended thinking blocks in the Messages API | Mitigated server-side |
| Thought signatures in Gemini API | Mitigated server-side |
Why does this matter for policy?
Because the rules being drafted right now assume this kind of thing gets disclosed. The SEC's cyber disclosure rule, adopted in July 2023 and effective December 2023, requires public companies to report material cybersecurity incidents within four business days of a materiality determination. A cross-tenant leak of customer secrets from a core AI service is exactly the fact pattern that forces that call.
The EU's AI Act, which entered into force in August 2024, layers a separate serious-incident reporting duty on providers of high-risk systems, with staggered application dates running through 2026. The reasoning-object design sits squarely in that scope.
Neither regime has been formally triggered by this disclosure. The closer fit for the downstream question, what does a developer owe its own customers when a dependency spills their credentials, is the updated Regulation S-P safeguards rule, whose final text took effect in 2024. We've tracked the API security beat closely: our 30 July story on overlooked weak spots in AI agent wrappers found researchers exploiting the same three vendors' surrounding software rather than the models themselves. This disclosure goes one layer deeper.
What should users and developers do now?
Rotate any API keys or passwords that were sent through a reasoning-mode call in recent months. Treat prompt content as logged content. For end users, the practical rule hasn't changed: don't paste live passwords or account secrets into a chat window, even one that promises privacy.
Common questions
Were consumer ChatGPT, Claude and Gemini chats affected?
This research targeted reasoning objects exchanged over the developer APIs. Consumer chat apps use related but separately managed pipelines and weren't the subject of the write-up.
Do I need to change my password?
Only if you pasted a password into a prompt that went to a reasoning-mode model, or you use a product that did so on your behalf. When in doubt, rotate.
