Breaking Lab srl
A Shared Blind Spot Across the AI Industry
In a disclosure that implicates three of the most powerful companies in artificial intelligence simultaneously, security researchers have uncovered a structural flaw in the way OpenAI, Anthropic, and Google manage encrypted reasoning data passed between API calls. The vulnerability allowed researchers to extract sensitive internal information — including API keys, passwords, and other credentials — from session logs, raising serious questions about the security assumptions baked into modern AI inference pipelines.
How the Flaw Works
At the heart of the issue are so-called “reasoning objects” — encrypted data structures that these providers use to carry intermediate reasoning steps between calls in their respective reasoning-focused APIs. The premise is that this internal chain-of-thought data is opaque and protected, giving developers the ability to build multi-step AI workflows without exposing sensitive logic. In practice, however, the encryption scheme did not prevent a reasoning block generated in one session from being replayed into an entirely different one.
When researchers performed this cross-session replay, the models would process the injected reasoning context as if it were their own — and in doing so, inadvertently surfaced secrets embedded within that context. API keys, database credentials, and SSH-style tokens that had appeared in prior sessions were recoverable by an attacker with the ability to intercept or reuse the relevant objects. The flaw was not limited to one provider’s implementation: all three companies’ reasoning APIs were found to be affected, suggesting the root cause lies in a common architectural assumption rather than a single team’s oversight.
Why Reasoning APIs Are a Distinct Attack Surface
Standard large language model APIs are largely stateless — each call begins fresh, and there is relatively little persistent state to exploit. Reasoning-oriented APIs, by contrast, are designed to maintain continuity across steps, enabling models like OpenAI’s o-series, Anthropic’s Claude with extended thinking, and Google’s Gemini reasoning variants to tackle multi-stage problems coherently. That continuity is precisely what makes them powerful — and precisely what introduced this vulnerability.
When encrypted reasoning objects are treated as tamper-proof tokens that can be freely passed between systems, they become an attractive target. A developer integrating a reasoning-capable model into an enterprise workflow might, for instance, pass context containing database connection strings or authentication tokens as part of the reasoning chain. If those objects can be replayed and decoded in a foreign session, that context leaks — silently and without triggering conventional intrusion detection.
The Coordinated Disclosure Picture
All three companies were notified before public disclosure, and the flaw has since been addressed. None of the providers have publicly confirmed whether any real-world exploitation occurred prior to the patch. However, the very fact that researchers were able to recover specific credential types — API keys, passwords — during testing indicates the attack is not merely theoretical. It requires relatively modest access to an API session and does not demand sophisticated reverse engineering of the encryption itself.
The companies involved have not issued detailed post-mortems at the time of writing, and it remains unclear exactly what mitigations were applied, whether they involved re-architecting how reasoning objects are scoped and validated, or simply adding session-binding constraints to the encrypted payloads.
What Enterprises Should Do Now
For organizations running production workloads on any of the three affected platforms, the immediate priority should be auditing API keys and credentials that may have appeared within reasoning-capable sessions. Rotating any secrets that were passed as context in multi-step reasoning calls is a prudent precaution, even absent confirmed compromise. Going forward, security teams should treat reasoning context as a sensitive data surface equivalent to a database query log — not a black box that can safely absorb arbitrary secrets.
A Signal for the Broader AI Security Landscape
This incident is significant beyond its technical specifics. It illustrates that as AI providers compete to build more capable, stateful, and context-aware systems, each new architectural layer introduces a corresponding new attack surface — one that may not be obvious to either the developers building on these APIs or the security researchers tasked with auditing them. The fact that the same class of flaw appeared independently across OpenAI, Anthropic, and Google suggests the industry would benefit from shared, independently audited security standards for reasoning APIs before they become the backbone of critical enterprise infrastructure.
