Encrypted AI reasoning extraction attacks

All three providers have patched a vulnerability in which encrypted reasoning blocks returned by their APIs were portable across sessions, users, and model siblings within the same provider family. Because a single encryption key covered all models in a family, an attacker could replay a stronger model's reasoning trace into a cheaper, less-safeguarded sibling and jailbreak that sibling into reading the reasoning aloud in plaintext. Researchers decoded 315,320 reasoning blocks from 6,708 public agent trajectories; 4.9% of sessions leaked at least one sensitive item. From real user sessions, the team recovered 62 API keys, 33 passwords, 24 access tokens, and 30 personal emails, with a separate count from the same dataset yielding 367 personal information items and 182 credentials. Claude Haiku 4.5 was exploitable via an assistant turn prefix trick removed in 4.6 models. A separate prompt injection variant caused downstream models to treat embedded exfiltration instructions as authoritative. Researchers also found Kimi K3 producing outputs strikingly similar to hidden reasoning traces from frontier models, characterized as evidence consistent with distillation.