API Flaw Exposes Encrypted Reasoning and Credentials Across OpenAI, Anthropic, Google
Researchers discovered that OpenAI, Anthropic, and Google's reasoning APIs shared a single global encryption key for protected reasoning blocks, allowing the blocks to be replayed across different accounts and models. By scanning public repositories, they recovered 182 API credentials and 367 pieces of personal information from previously published session logs.
What happened
Researchers discovered that OpenAI, Anthropic, and Google's reasoning APIs used a single shared global encryption key for encrypted reasoning blocks, allowing the blocks to be replayed across different sessions, accounts, and models.
By scanning 6,708 public agent trajectories on GitHub and Hugging Face, researchers decoded 315,320 reasoning blocks and recovered 182 API credentials and 367 distinct pieces of personally identifiable information from published session logs.
The encryption was designed to prevent tampering during stateless API calls, but did not bind encrypted blocks to specific sessions, users, or models, enabling weaker sibling models to be prompted to read encrypted reasoning from other accounts.
Reported impact
Developers who published raw agent session logs before August 2026 unknowingly exposed API keys, passwords, and personally identifiable information inside encrypted blocks they believed were opaque and unreadable.
Index analysis
The flaw exposed that encrypted reasoning traces could be fully interchanged across different sessions, user accounts, and models within each provider's ecosystem.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.