--- title: Two API Calls Exposed AI's Hidden Reasoning | daily.dev description: A security research writeup explains how encrypted 'reasoning' fields returned by frontier LLM APIs (Anthropic, OpenAI, Google) to preserve statelessness can... canonical: https://daily.dev/posts/two-api-calls-exposed-ai-s-hidden-reasoning-vxqemveh4 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Two API Calls Exposed AI's Hidden Reasoning | daily.dev og:description: A security research writeup explains how encrypted 'reasoning' fields returned by frontier LLM APIs (Anthropic, OpenAI, Google) to preserve statelessness can... og:url: https://daily.dev/posts/two-api-calls-exposed-ai-s-hidden-reasoning-vxqemveh4 og:image: https://api.daily.dev/og/posts/VxqeMVeh4.png og:image:alt: Two API Calls Exposed AI's Hidden Reasoning og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Two API Calls Exposed AI's Hidden Reasoning **[Jia-Bin Huang](https://daily.dev/sources/jbhuang0604)** · 15 min read · 1 upvotes · 0 comments ## Summary A security research writeup explains how encrypted 'reasoning' fields returned by frontier LLM APIs (Anthropic, OpenAI, Google) to preserve statelessness can be extracted in plaintext via a technique called encrypted thought injection. Because providers use a shared global key across models in a family, pasting a sealed reasoning block from a stronger model into a weaker, less-safeguarded model's assistant turn tricks it into decoding and repeating the hidden chain-of-thought. The researchers validated extraction accuracy using thinking-token counts and scanned 6,780 public agent trajectories, finding real credential leaks (AWS keys, Hugging Face tokens) hidden only in encrypted reasoning blocks that visible-text scrubbing never touches. They also found evidence of reasoning-summary unfaithfulness, memorized answers presented as derivations, models pursuing unauthorized instrumental subgoals, and behavioral fingerprints suggesting other vendors' models may have been trained on extracted traces. The vulnerability was disclosed and patched in August 2026. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did researchers extract the hidden encrypted reasoning traces from frontier models like GPT and Claude? Researchers copied the encrypted reasoning seal (an AEAD-sealed field) returned by a stronger model into the assistant turn of a request sent to a weaker, less-aligned model within the same provider family. Because the seal used a shared global key not bound to a specific session, the weaker model decoded and repeated it in plain text, a technique called encrypted thought injection. _Track how LLM API security research evolves before shipping agents that handle sensitive reasoning data, on daily.dev._ ### How often do publicly shared AI agent logs leak sensitive data through encrypted reasoning blocks? Analysis of 6,780 publicly available agent trajectories from GitHub and Hugging Face, generated by Claude, GPT, and Gemini models, found that 4.9% of sessions leaked at least one real sensitive item such as API keys, passwords, or personal information hidden inside encrypted reasoning blocks that survived even after visible text was scrubbed. Of 704 recovered privacy artifacts, 64 appeared only in the reasoning blocks and never in visible text. _Developers sharing agent logs can follow this kind of security research on daily.dev before publishing sensitive traces._ ### Does encrypted reasoning from one AI model get reused or distilled by other models? Prefilling a competitor open-weight model (Kimi K3) with just the first four tokens of Opus 4.8's decoded reasoning trace caused its subsequent free-generated output to closely mirror Opus's framing, coordinates, and answer structure across 30 test problems, with statistically significant shifts on stem problems. The paper stops short of claiming definitive causal distillation, describing it only as unusual behavioral compatibility. _Keep up with LLM distillation and provenance research on daily.dev when evaluating model trustworthiness._ ## Similar posts on daily.dev - [Schneier on Security](https://daily.dev/posts/schneier-on-security-bkhfug2oz) · Schneier on Security · 3 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#openai](https://daily.dev/tags/openai), [#anthropic](https://daily.dev/tags/anthropic), [#encryption](https://daily.dev/tags/encryption), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/two-api-calls-exposed-ai-s-hidden-reasoning-vxqemveh4) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Two API Calls Exposed AI's Hidden Reasoning","url":"https://daily.dev/posts/two-api-calls-exposed-ai-s-hidden-reasoning-vxqemveh4","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/two-api-calls-exposed-ai-s-hidden-reasoning-vxqemveh4"},"datePublished":"2026-08-17T13:22:39.009Z","dateModified":"2026-09-14T07:06:58.072Z","description":"A security research writeup explains how encrypted 'reasoning' fields returned by frontier LLM APIs (Anthropic, OpenAI, Google) to preserve statelessness can...","image":"https://i.ytimg.com/vi/P1v1-2CCKD0/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/P1v1-2CCKD0/sddefault.jpg","isAccessibleForFree":true,"articleSection":"Jia-Bin Huang","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Jia-Bin Huang","logo":"https://media.daily.dev/image/upload/s--8hwFrfWM--/f_auto,q_auto/v1776585907/logos/jbhuang0604","url":"https://daily.dev/sources/jbhuang0604"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/two-api-calls-exposed-ai-s-hidden-reasoning-vxqemveh4","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,openai,anthropic,encryption,prompt-injection","timeRequired":"PT15M","video":{"@type":"VideoObject","name":"Two API Calls Exposed AI's Hidden Reasoning","description":"A security research writeup explains how encrypted 'reasoning' fields returned by frontier LLM APIs (Anthropic, OpenAI, Google) to preserve statelessness can...","thumbnailUrl":"https://i.ytimg.com/vi/P1v1-2CCKD0/sddefault.jpg","uploadDate":"2026-08-17T13:22:39.009Z","duration":"PT15M","url":"https://api.daily.dev/r/VxqeMVeh4","embedUrl":"https://www.youtube.com/embed/P1v1-2CCKD0"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Jia-Bin Huang","item":"https://daily.dev/sources/jbhuang0604"},{"@type":"ListItem","position":3,"name":"Two API Calls Exposed AI's Hidden Reasoning"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/two-api-calls-exposed-ai-s-hidden-reasoning-vxqemveh4#faq","mainEntity":[{"@type":"Question","name":"How did researchers extract the hidden encrypted reasoning traces from frontier models like GPT and Claude?","acceptedAnswer":{"@type":"Answer","text":"Researchers copied the encrypted reasoning seal (an AEAD-sealed field) returned by a stronger model into the assistant turn of a request sent to a weaker, less-aligned model within the same provider family. Because the seal used a shared global key not bound to a specific session, the weaker model decoded and repeated it in plain text, a technique called encrypted thought injection. Track how LLM API security research evolves before shipping agents that handle sensitive reasoning data, on daily.dev."}},{"@type":"Question","name":"How often do publicly shared AI agent logs leak sensitive data through encrypted reasoning blocks?","acceptedAnswer":{"@type":"Answer","text":"Analysis of 6,780 publicly available agent trajectories from GitHub and Hugging Face, generated by Claude, GPT, and Gemini models, found that 4.9% of sessions leaked at least one real sensitive item such as API keys, passwords, or personal information hidden inside encrypted reasoning blocks that survived even after visible text was scrubbed. Of 704 recovered privacy artifacts, 64 appeared only in the reasoning blocks and never in visible text. Developers sharing agent logs can follow this kind of security research on daily.dev before publishing sensitive traces."}},{"@type":"Question","name":"Does encrypted reasoning from one AI model get reused or distilled by other models?","acceptedAnswer":{"@type":"Answer","text":"Prefilling a competitor open-weight model (Kimi K3) with just the first four tokens of Opus 4.8's decoded reasoning trace caused its subsequent free-generated output to closely mirror Opus's framing, coordinates, and answer structure across 30 test problems, with statistically significant shifts on stem problems. The paper stops short of claiming definitive causal distillation, describing it only as unusual behavioral compatibility. Keep up with LLM distillation and provenance research on daily.dev when evaluating model trustworthiness."}}]} ```