AI Providers’ Encrypted Reasoning Flaws Exposed Sensitive Data in Major LLMs
A critical security vulnerability in how leading AI providers including OpenAI, Anthropic, and Google handle encrypted "chain-of-thought" reasoning traces has exposed hidden internal data, including personally identifiable information (PII) and hardcoded credentials. Discovered by researchers from the ELLIS Institute Tübingen, Max Planck Institute, MATS Research, and Snyk, the flaw affects flagship models like GPT-5.6, Claude Opus 4.8, and Gemini 3, requiring only standard API access to exploit.
The issue stems from how AI providers encrypt reasoning traces internal processing steps containing proprietary logic and safety checks before transmitting them to clients. While these traces are withheld from plain-text responses, they are sent as encrypted, base64-encoded envelopes for multi-turn conversations. However, the cryptographic signatures used to authenticate these envelopes rely on global, provider-wide keys rather than being tied to specific user sessions, model tiers, or accounts.
This lack of binding allowed attackers to replay encrypted reasoning blocks from high-security flagship models into weaker, less-guarded sibling models (e.g., Claude Haiku 4.5 or GPT-5-mini). Since lighter models lack the same safety guardrails, they would comply with prompts to decode and output the hidden reasoning in plain text. Researchers demonstrated this across OpenAI’s GPT, Anthropic’s Claude, and Google’s Gemini ecosystems, confirming the attack’s effectiveness by matching decoded token lengths with API-reported usage data.
The real-world impact was severe. Analyzing 6,708 public agent transcripts from GitHub and Hugging Face, the team extracted 315,320 reasoning blocks, uncovering 367 PII artifacts and 182 hardcoded credentials including 62 API keys, 33 passwords, and 30 email addresses. Much of this sensitive data was never visible in the models’ final responses, leaving developers unaware of the exposure.
Beyond data leaks, the flaw enabled stealthy prompt injection attacks. Malicious instructions embedded in encrypted reasoning blocks could bypass monitoring tools that inspect only visible conversation history, compromising autonomous AI agents without detection.
Following responsible disclosure, OpenAI, Anthropic, and Google acknowledged the findings and deployed server-side mitigations, rendering the original attack methods ineffective on current API builds. The researchers recommended fixes such as cryptographic binding of envelopes to specific models and sessions, strict model isolation, key rotation, and log sanitization to prevent future exposures.
Source: https://cybersecuritynews.com/top-ai-models-apis-flaw-exposes-hidden-reasoning/
Google cybersecurity rating report: https://www.rankiteo.com/company/google
Anthropic cybersecurity rating report: https://www.rankiteo.com/company/anthropicresearch
OpenAI cybersecurity rating report: https://www.rankiteo.com/company/openai
"id": "GOOANTOPE1786465634",
"linkid": "google, anthropicresearch, openai",
"type": "Vulnerability",
"date": "8/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Artificial Intelligence',
'name': 'OpenAI',
'type': 'AI Provider'},
{'industry': 'Artificial Intelligence',
'name': 'Anthropic',
'type': 'AI Provider'},
{'industry': 'Technology',
'name': 'Google',
'type': 'AI Provider'}],
'attack_vector': 'API Exploitation',
'data_breach': {'data_encryption': 'Weak (global provider-wide keys)',
'data_exfiltration': 'Yes (extracted from public agent '
'transcripts)',
'number_of_records_exposed': '315,320 reasoning blocks (367 '
'PII artifacts, 182 hardcoded '
'credentials)',
'personally_identifiable_information': 'Yes (367 artifacts)',
'sensitivity_of_data': 'High (PII, API keys, passwords)',
'type_of_data_compromised': ['Personally identifiable '
'information (PII)',
'Hardcoded credentials (API '
'keys, passwords, email '
'addresses)']},
'description': 'A critical security vulnerability in how leading AI providers '
'including OpenAI, Anthropic, and Google handle encrypted '
"'chain-of-thought' reasoning traces has exposed hidden "
'internal data, including personally identifiable information '
'(PII) and hardcoded credentials. The flaw affects flagship '
'models like GPT-5.6, Claude Opus 4.8, and Gemini 3, requiring '
'only standard API access to exploit. The issue stems from '
'cryptographic signatures relying on global, provider-wide '
'keys rather than being tied to specific user sessions or '
'model tiers, allowing attackers to replay encrypted reasoning '
'blocks from high-security models into weaker models to decode '
'and expose hidden data.',
'impact': {'brand_reputation_impact': 'Potential reputational damage to AI '
'providers due to exposure of sensitive '
'data',
'data_compromised': 'Personally identifiable information (PII), '
'hardcoded credentials (API keys, passwords, '
'email addresses)',
'identity_theft_risk': 'High (exposure of PII and credentials)',
'operational_impact': 'Potential compromise of autonomous AI '
'agents via stealthy prompt injection '
'attacks',
'systems_affected': 'AI models (GPT-5.6, Claude Opus 4.8, Gemini '
'3, and lighter models like Claude Haiku 4.5, '
'GPT-5-mini)'},
'investigation_status': 'Resolved (mitigations deployed)',
'lessons_learned': 'Need for cryptographic binding of encrypted data to '
'specific models/sessions, strict model isolation, key '
'rotation, and log sanitization to prevent similar '
'exposures.',
'motivation': 'Security Research',
'post_incident_analysis': {'corrective_actions': 'Server-side mitigations, '
'cryptographic binding, '
'model isolation, key '
'rotation, log sanitization',
'root_causes': 'Global provider-wide cryptographic '
'keys for encrypted reasoning '
'traces, lack of binding to user '
'sessions/model tiers, insufficient '
'guardrails in lighter models'},
'recommendations': ['Cryptographically bind encrypted reasoning envelopes to '
'specific models and sessions',
'Enforce strict model isolation',
'Implement key rotation policies',
'Sanitize logs to prevent data leakage'],
'references': [{'source': 'ELLIS Institute Tübingen, Max Planck Institute, '
'MATS Research, Snyk'}],
'response': {'containment_measures': 'Server-side mitigations deployed by '
'OpenAI, Anthropic, and Google',
'remediation_measures': 'Cryptographic binding of envelopes to '
'specific models/sessions, strict model '
'isolation, key rotation, log '
'sanitization'},
'threat_actor': 'Researchers (ELLIS Institute Tübingen, Max Planck Institute, '
'MATS Research, Snyk)',
'title': 'AI Providers’ Encrypted Reasoning Flaws Exposed Sensitive Data in '
'Major LLMs',
'type': 'Data Breach',
'vulnerability_exploited': 'Improper cryptographic binding of encrypted '
'reasoning traces to user sessions/model tiers'}