Security researchers from the ELLIS Institute and the Max Planck Institute have exposed a fundamental architectural vulnerability in the application programming interfaces of leading AI providers. Between August 9 and August 11, 2026, they published their research on stealing reasoning traces from proprietary language models. The vulnerability affects major industry systems from OpenAI, Anthropic, and Google. Leading vendors return hidden chain-of-thought processes as encrypted text blocks to the client to protect intellectual property. This practice is designed to prevent competitors from extracting internal reasoning steps through distillation techniques.
However, the researchers discovered that these encrypted blocks were cross-model compatible and interchangeable within a single provider ecosystem. This flaw created a severe vector for targeted API attacks across different model tiers. An attacker could intercept the encrypted reasoning block generated by a flagship model such as Claude Opus. This intercepted block was then forwarded to a much weaker model within the same family, such as Claude Haiku.
Because smaller models feature significantly weaker safety guardrails, they were far easier to manipulate. The researchers leveraged this weakness to jailbreak the smaller model into outputting the secret reasoning trace in plain text. The extent of the associated data leak proved to be substantial during the investigation. By systematically parsing 315,320 public agent trajectories on platforms like GitHub and Hugging Face, sensitive data was recovered.
In total, the researchers identified 704 confidential data items hidden within the published agent logs. Among the recovered items were 62 API keys as well as 33 passwords and access tokens. Users had inadvertently published these credentials because they were embedded inside the encrypted reasoning blocks. The affected providers were notified and immediately deployed initial countermeasures. These patches are designed to block cross-model replay attacks across all endpoints.
The incident highlights the ongoing security challenges of separating encrypted user communications from internal model states. Developers integrating autonomous AI agents must rigorously filter what data enters prompt contexts. The discovery clearly demonstrates that hidden reasoning chains pose security risks unless cryptographically bound to specific models. This discovery reopens critical debates regarding API security standards and transparency.