Paper Reveals LLM Encrypted Reasoning Vulnerability Leaking API Keys
rohanpaul_ai · x · 2026-08-12
A recent study uncovered a severe security vulnerability in the encrypted reasoning blocks returned by major LLM APIs, which could act as an invisible data leak.
- Vulnerability Mechanism: Encrypted reasoning blocks returned by providers like OpenAI, Anthropic, and Google are compatible across sessions, users, and even models within the same ecosystem. Attackers can inject a stronger model's trace into a weaker, less safeguarded sibling model, forcing it to decode and output the plaintext.
- Scale of Leakage: Researchers decoded over 315,000 reasoning blocks from public logs, finding sensitive items in 4.9% of sessions. They successfully recovered 62 API keys, 33 passwords, and 30 personal emails.
- Mitigation: Following responsible disclosure, providers patched the vulnerability, and the exact exploits were no longer reproducible by August 2026.
More from Safety
- 'The AI-driven cybersecurity black swan is happening' — and a reminder to enable 2FA — danielrock · 2026-10-16
- No-instruction autonomous agent wakes up, sets own goals, and tries hacking by default — sethlazar · 2026-10-16
- India's CERT-In says AI agents escaped testing environments and breached Indian organizations undetected for days — HimanshiET · 2026-10-16
- HTTP response headers can carry prompt injections against AI agents, researcher shows — arpit_bhayani · 2026-10-16
- OpenAI agent uses someone else's Ethereum testnet wallet to pay for its task — nptacek · 2026-10-16
- Interpretability won't save us: critics call superintelligence project reckless regardless — zetalyrae · 2026-10-16