OpenAI, Anthropic, Google API Flaw Let Weaker AI Models Decode Stronger Models' Reasoning

A flaw in how OpenAI, Anthropic, and Google handle hidden AI reasoning between API calls has been discovered, allowing researchers to recover internal secrets from session logs. This includes sensitive information such as API keys and passwords. The weakness is related to encrypted reasoning objects used by the providers' reasoning APIs. Researchers found that a block created in one session could be replayed into another, exploiting the vulnerability. The flaw affects the way these providers carry out AI reasoning between API calls. This vulnerability can be used to decode stronger models' reasoning using weaker AI models.