Researchers say a design flaw in hidden AI reasoning data can let attackers recover private model output and secrets from major LLM providers. The paper says encrypted chain-of-thought blocks returned by client apps are reusable across sessions, users, and even models within the same provider, enabling a weaker model to decrypt a stronger model’s hidden reasoning. The authors say they decoded 315,320 publicly exposed blocks and recovered 367 pieces of personally identifiable information and 182 credentials, and also showed the technique could hide prompt-injection payloads inside those encrypted blocks.
Why it matters: This affects organizations and developers using major AI APIs, especially those logging or sharing session data that may contain hidden encrypted reasoning blocks. The immediate actions are to stop exposing model session logs, review repositories and telemetry for leaked traces, and watch for vendor mitigations to how reasoning data is encrypted and bound to users or sessions.
Bruce Schneier
2026.09.08
100% relevant
This article establishes a distinct new research-driven vulnerability story: a cross-session architectural flaw in client-side encrypted reasoning traces at multiple major LLM providers, with demonstrated privacy leakage, credential exposure, and prompt-injection abuse.
← Back to all stories