Encrypted Reasoning Traces in OpenAI, Anthropic, Google APIs Exposed 704 Private Artifacts Across Public Agent Logs

The core issue stems from design choices for stateless API sessions. OpenAI, Anthropic and Google each return opaque encrypted reasoning items intended for manual replay across calls. These blocks proved portable across sessions, users and model tiers, allowing a weaker model to transcribe the stronger model's internal chain without breaking encryption. The attack required only an intact block and compatible API access, not key material.

Analysis of the 6,708 trajectories yielded 704 non-benchmark privacy artifacts, 64 of which appeared exclusively inside the hidden reasoning and never in visible output. This pattern reveals a systemic gap: visible-trace sanitization leaves opaque fields untouched, turning published agent logs into cross-user data sources. The same portability enabled proof-of-concept invisible prompt injection carried inside reasoning signatures.

Providers received disclosure and deployed mitigations that rendered the primary extraction non-reproducible by August 2026. No in-the-wild exploitation is documented. The exposure surface is narrow but concentrated among developers who publish raw transcripts, a growing cohort as agent frameworks normalize reasoning persistence.

Operational significance lies in the precedent for reasoning-state leakage in any stateless LLM deployment. Future agent platforms will face pressure to either encrypt with session binding or drop reasoning objects entirely before logging.