OpenAI, Anthropic and Google blocked a cross-model reasoning attack

Researchers Alexander Panfilov, David Schmotz, and Ilia Shumailov found a way to recover encrypted reasoning from models by OpenAI, Anthropic, and Google, as detailed in a paper posted on August 10th. The attack moved encrypted reasoning blocks between users, sessions, and models within the same provider's product family, using a weaker model to transcribe hidden material. In tests on 120 Codeforces problems, token counts tracked closely, and analysis of 6,708 public agent trajectories flagged 1,028 blocks (0.3%) with at least one privacy leak.

Alexander Panfilov @kotekjedi ml https://x.com/kotekjedi ml , David Schmotz and Ilia Shumailov @iliaishacked https://x.com/iliaishacked found a way to recover encrypted reasoning generated by models from OpenAI, Anthropic and Google, according to a paper posted on August 10th https://arxiv.org/abs/2608.09867 . The attack exploited a convenience built into reasoning-model APIs. Providers can return a model's hidden chain of thought as an encrypted block that customers store and send back during later requests. Official OpenAI guidance https://openai.com/business/guides-and-resources/a-practical-guide-to-building-with-ai/ describes passing back encrypted reasoning items in client-managed workflows, while Google's documentation https://ai.google.dev/gemini-api/docs/generate-content/thought-signatures says Gemini thought signatures preserve reasoning context across API calls. The researchers found that these blocks could be moved between users, sessions and models inside the same provider's product family. They fed reasoning from a stronger model into a cheaper, weaker sibling, then prompted the smaller model to transcribe the hidden material. The stronger model's safeguards never had to approve the disclosure. Panfilov is a MATS fellow whose previous work has examined how prompt injections can defeat AI control monitors https://www.matsprogram.org/research/adaptive-attacks-on-trusted-monitors-subvert-ai-control-protocols . The paper's other authors are Luca Beurer-Kellner @lbeurerkellner https://x.com/lbeurerkellner , Joachim Schaeffer @JSchaeff3r https://x.com/JSchaeff3r , Ameya Prabhu @AmyPrb https://x.com/AmyPrb , Jonas Geiping @jonasgeiping https://x.com/jonasgeiping and Maksym Andriushchenko @maksym andr https://x.com/maksym andr . Their affiliations include MATS Research, the ELLIS Institute Tubingen, the Max Planck Institute for Intelligent Systems, the Tubingen AI Center, Snyk, the University of Tubingen and AI Sequrity Company. A weaker model became the decoder The researchers tested the attack against API versions available in early July 2026. For Anthropic, they moved encrypted reasoning from more capable Claude models into Haiku 4.5. They used GPT-5.6 Luna as a decoder for OpenAI reasoning and Gemini Robotics 1.6 for Google traces. Their validation has an important limit. The researchers lacked access to the providers' original plaintext chain of thought, so they could not compare each recovered word against a definitive source. They instead compared extracted length with the APIs' reported reasoning-token counts and inspected whether the recovered text contained details absent from visible summaries. The paper says the token counts tracked closely across tests on 120 Codeforces problems, indicating that the extraction recovered much of the hidden trace. The method created four attack paths. A developer could collect reasoning for model distillation, recover private data from another user's published logs, reveal harmful details that appeared in hidden reasoning despite a safe final answer, or place invisible instructions inside an encrypted block that an agent later treats as its own prior thought. The last scenario turns reasoning continuity into a prompt-injection channel. In one proof of concept, the researchers placed an instruction to upload a PowerPoint file inside an encrypted reasoning block. A later model produced an editing script that also sent the presentation to an attacker-controlled server, while the visible conversation contained no corresponding instruction. Public logs contained credentials The researchers collected 6,708 publicly available agent trajectories from GitHub and Hugging Face and reconstructed 315,320 reasoning blocks. Their automated review flagged at least one privacy leak in 1,028 blocks, or 0.3% of the sample. At the session level, 328 trajectories, or 4.9%, contained at least one item the paper classified as sensitive. Across the full dataset, including synthetic benchmark sessions, the researchers counted 367 personally identifiable information artifacts and 182 credentials. Genuine user sessions yielded 62 distinct API keys, 33 passwords and 30 personal email addresses, according to the paper. Some artifacts appeared only inside the encrypted reasoning and were absent from the visible conversation, meaning conventional log sanitization would not have found them. Those figures require context. The dataset was a targeted collection rather than an audit of all public agent logs, and benchmark trajectories accounted for much of the personal information because some tests deliberately supply models with synthetic identities. The researchers said they deleted recovered secrets after classification. Providers blocked the reported attacks The paper builds on cryptographer Matthew Green's May 29th analysis of encrypted reasoning https://blog.cryptographyengineering.com/2026/05/ , which showed that reasoning blocks could be replayed outside their original context. Green reported the behavior to OpenAI and Anthropic, while describing the immediate security impact as uncertain. Panfilov and his coauthors extended that finding by using weaker models as transcription tools and applying the technique to public logs. They disclosed their methods to the affected model providers, Microsoft and Hugging Face before publication. The paper says every model provider acknowledged the report and that the researchers subsequently could no longer reproduce the same attacks. AI security researcher Timothee Chauvin @timotheechauvin https://x.com/timotheechauvin described the issue as limited in consequence in a seven-post thread on X https://x.com/timotheechauvin/status/2087080608946131097 , while criticizing the providers for leaving a basic security weakness across encrypted reasoning systems. The researchers proposed binding each encrypted block to its original user, session and place in the conversation. They also recommended rotating old keys so reasoning blocks issued before a fix become unreadable, training models to reject transcription requests and moving reasoning storage back to provider servers where practical. Those changes carry costs. Client-held reasoning supports stateless APIs, zero-data-retention deployments and model switching without requiring providers to retain every hidden trace. The vulnerability came from preserving that portability too broadly. The same block that kept an agent's reasoning intact across requests also crossed boundaries that encryption was expected to enforce.