FHN 
A new security research report has uncovered a serious weakness in the way major AI providers protect the hidden reasoning generated by their large language models.
The research involves OpenAI, Anthropic, and Google, and shows that encrypted reasoning data produced by powerful models could potentially be reused with less restricted models from the same provider. In some cases, this could allow the hidden reasoning to be reconstructed in readable text.
Researchers from the ELLIS Institute Tübingen, Max Planck Institute, MATS Research, and Snyk investigated the issue across the Claude, GPT, and Gemini ecosystems. The attack does not require special privileges and can be carried out through normal API access.
How the Attack Works
Modern reasoning models perform additional processing before producing their final answers. Much of this internal reasoning is intentionally hidden from users because it may contain sensitive information, system instructions, safety-related decisions, or proprietary model behavior.
Instead of keeping all conversation state on the server, some AI APIs return encrypted data that can be sent back with later requests. This allows the model to continue a conversation without storing every detail on the provider’s side.
Researchers found a potential weakness in how these encrypted reasoning packages were protected.
The data was not sufficiently tied to the specific model, user, or session that originally created it. This meant a reasoning package generated by a more heavily protected model could potentially be submitted to another model within the same provider’s ecosystem.
Using Smaller Models to Reveal Hidden Data
The researchers demonstrated an attack technique in which a reasoning package from a powerful model was passed to a less restricted model.
The smaller model could then be prompted to reproduce information contained inside the encrypted package.
This creates an unusual security problem. The attacker does not necessarily need to break the encryption directly. Instead, another model can potentially act as an intermediary that helps expose the information.
The research team reported similar behavior across the GPT, Claude, and Gemini model families.
Researchers also compared the recovered reasoning data with usage information provided through the APIs to determine whether the extracted material corresponded to the original reasoning process.
Hidden Reasoning Can Contain Sensitive Information
The concern goes beyond exposing how an AI model thinks.
Researchers analyzed thousands of publicly available AI agent transcripts collected from sources such as GitHub and Hugging Face. Their analysis identified hundreds of pieces of potentially sensitive information inside recovered reasoning data.
This included:
- 367 pieces of personally identifiable information
- 182 hardcoded credentials
- 62 API keys
- 33 passwords
- 30 personal email addresses
The problem is that some of this information may never appear in the model’s visible response.
A developer could therefore publish an AI session or agent log believing it contains no secrets, while sensitive information remains hidden inside associated reasoning data.
A New Risk for AI Agents
The research also highlights a potential problem for autonomous AI systems.
If security monitoring only examines the visible conversation between a user and an AI agent, malicious instructions hidden inside reasoning-related data could potentially escape detection.
An attacker could attempt to place instructions inside an encrypted reasoning package and have those instructions processed later by an AI agent.
This creates a potential indirect prompt injection scenario where the malicious content is not obvious in the conversation that security tools are monitoring.
For organizations using AI agents to interact with cloud services, databases, code repositories, or business applications, this type of hidden input deserves particular attention.
Which AI Platforms Were Studied?
The research covered major model ecosystems from three providers:
| Provider | Models Studied | Potential Risk |
|---|---|---|
| Anthropic | Claude family | Hidden reasoning, system prompts, credentials |
| OpenAI | GPT family | Reasoning data, safety information, sensitive content |
| Gemini family | Secrets, hidden instructions, and personal information |
The exact attack paths and model combinations varied between providers, but the broader issue was similar: reasoning data was not sufficiently isolated from other models within the same ecosystem.
Providers Have Already Responded
The researchers reported the findings to the affected companies through responsible disclosure.
OpenAI, Anthropic, and Google acknowledged the research and introduced server-side protections. According to the researchers, the original proof-of-concept attacks could no longer be reproduced against the updated API implementations.
That reduces the immediate risk from the specific attack demonstrated in the research, but the findings highlight a larger issue for the AI industry.
As AI systems become more complex, security controls need to protect not only visible prompts and responses but also the internal data exchanged between models and supporting services.
How Organizations Can Reduce the Risk
AI providers and companies building applications around LLMs can take several steps to protect sensitive reasoning-related data.
Bind encrypted data to its source. Reasoning packages should be cryptographically linked to the specific model, user, and session that created them.
Separate model tiers. A payload generated by one model should not automatically be accepted by another model unless that behavior is explicitly intended and securely controlled.
Rotate older cryptographic keys. Where historical encrypted data may have been exposed, organizations should consider key rotation and invalidation strategies.
Protect AI logs. Developers should treat reasoning-related payloads, signatures, and encrypted model data as sensitive information. These fields should be removed or sanitized before logs are shared publicly.
Why This Matters
The research shows that protecting AI systems is not only about securing the model itself.
Modern LLM platforms involve APIs, model tiers, encrypted payloads, agent frameworks, logging systems, and multiple supporting services. A weakness in the connection between these components can create a security problem even when the underlying model remains protected.
For organizations adopting AI agents and reasoning models, the lesson is clear: hidden data should be treated as sensitive data, even when users cannot see it.
About the Author
