Loading story…
Researchers disclosed an architectural flaw in the reasoning APIs used by OpenAI, Anthropic, and Google that allowed hidden chain-of-thought or opaque reasoning objects from stronger models to be replayed into weaker compatible models and returned in plain text. The issue reportedly stemmed from reasoning envelopes not being cryptographically bound to a specific model, user, or session, enabling recovery of concealed reasoning, embedded secrets, and potentially harmful hidden content using only normal API access.
In tests across 6,708 public agent trajectories from platforms including GitHub and Hugging Face, the researchers said they decoded 315,320 thinking blocks and found 704 privacy artifacts from real user sessions, including API keys, passwords, access tokens, private keys, and other PII. The researchers warned the flaw could also support stealthy indirect prompt injection against autonomous agents, and said they disclosed the issue to the affected providers as well as Microsoft and Hugging Face; OpenAI, Anthropic, and Google acknowledged or addressed the findings with server-side mitigations that reportedly stopped the original proof-of-concept attacks.
Track how attackers are adapting to this technology.
9 events from the most recent confirmed update back to the earliest known activity.
OpenAI, Anthropic, and Google deployed server-side mitigations that made the original cross-model replay proof-of-concept attacks no longer reproducible. The paper's reproducibility statement said the main extraction attack was no longer reproducible as of August 2026.
According to the report, Matthew Green submitted the replay behavior to OpenAI and Anthropic through their bug-bounty programs. The later paper cited this as earlier related disclosure activity.
Earlier research by Johns Hopkins cryptographer Matthew Green showed that encrypted reasoning blocks could be replayed across sessions and accounts in OpenAI and Anthropic systems. This prior work established the replay behavior that later research expanded into a broader extraction attack.
A collaborative team from the ELLIS Institute Tübingen, Max Planck Institute, MATS Research, and Snyk publicly disclosed the architectural flaw affecting OpenAI, Anthropic, and Google APIs. They described how provider-wide authenticated reasoning envelopes could be replayed across users, sessions, and models to expose hidden chain-of-thought and secrets.
All three affected AI providers acknowledged the research findings about hidden reasoning exposure and replay across compatible models. Their acknowledgments were reported alongside the disclosure of the flaw.
The researchers reported the issue to OpenAI, Anthropic, Google, Microsoft, and Hugging Face. The disclosures covered the replay and extraction risks associated with hidden reasoning objects in provider APIs.
The paper included a proof of concept in which a malicious instruction was embedded inside an opaque reasoning block and replayed into an unrelated task. The receiving model carried out an attacker-directed upload action without exposing the injected instruction in visible text.
The researchers showed that opaque reasoning objects from stronger models could be replayed into weaker compatible models within the same provider family, causing hidden reasoning to be returned in plain text. They documented this across Anthropic Claude, OpenAI GPT, and Google Gemini model families.
The research team analyzed 6,708 public agent transcripts or trajectories from GitHub and Hugging Face and decoded 315,320 hidden reasoning blocks. They recovered sensitive artifacts including PII, API keys, passwords, access tokens, private keys, and other credentials from genuine user sessions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
heise.de
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed a flaw in encrypted reasoning objects used by major AI reasoning APIs, including **OpenAI**, **Anthropic**, and **Google**, that allowed hidden model reasoning to be reconstructed by replaying opaque reasoning blobs across sessions and, in some cases, across compatible models. The attack did not break encryption directly; instead, it exploited the fact that receiving systems would accept reused encrypted reasoning artifacts, letting weaker or more easily jailbroken models act as approximate decoders for stronger models’ concealed reasoning. Reported risks included extraction of proprietary reasoning, recovery of sensitive data from shared traces, reconstruction of harmful hidden material, and prompt injection hidden inside encrypted reasoning objects. A practical reproduction showed the technique working against OpenAI models across separate sessions and accounts, recovering semantic reasoning content and even a password present in an original trace. Researchers said they decoded **315,320** reasoning blocks from **6,708** public agent trajectories and recovered hundreds of privacy-related artifacts, including **API keys, passwords, access tokens, private keys, and other PII**. The issue was disclosed to OpenAI, Anthropic, Google, Microsoft, and Hugging Face, and the primary extraction method was reported to be no longer reproducible after mitigations, although testing indicated inconsistent behavior over time. Researchers said they found no evidence of active exploitation, but warned developers not to publish or retain raw agent traces containing opaque reasoning fields.
Aug 17, 2026
Research from Novee Security found that default AI agent harnesses from major vendors could be abused to exfiltrate secrets, bypass trust boundaries, and chain individually approved actions into harmful outcomes. Elad Meged reported multiple issues affecting Anthropic, Google, and OpenAI tooling, arguing that the root problem lies in architectural trust decisions, approval logic, and cross-stage handoffs rather than prompt injection alone. One Google Gemini CLI issue was tracked as **`GHSA-wpqr-6v78-jr5g`** with a **CVSS 10.0** rating, while weaknesses were also identified in Anthropic's Claude Code Action and OpenAI's Codex CLI sandbox. The findings showed how controls can fail when agent components such as tools, memory, prompts, and execution environments trust each other too broadly. Researchers said Google's agent could be pushed into a supply-chain-style attack that wrote to its own GitHub repository, illustrating how safe-looking steps can combine into exploitable workflows. Vendors have added mitigations and fixes, but the repeated pattern across products points to a broader industry problem for organizations deploying autonomous agents on untrusted input, especially where human review is limited or absent.
Jul 31, 2026
Researchers disclosed multiple vulnerabilities in enterprise AI agent frameworks that allowed attackers to bypass model authorization, trigger tools directly, and in some cases achieve **remote code execution**. Check Point reported 11 flaws across **LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, and Google ADK**, spanning insecure deserialization, **SSRF**, path traversal, and use-after-free. One critical issue in Microsoft Agent Framework let untrusted state data reach insecure checkpoint deserialization, enabling RCE; Microsoft fixed the bug and said no `CVE` was assigned because the product was not generally available. A separate disclosure described a cross-platform pattern dubbed **CoreBreak**, where execution layers in **Amazon Bedrock AgentCore, Google ADK, and Vercel AI SDK harnesses** accepted tool-call-shaped data without confirming that a legitimate model turn had authorized the action. AWS assigned **`CVE-2026-18830`** and automatically patched the managed service, Google fixed **`CVE-2026-18236`** in ADK for Python version **2.5.0**, and Vercel patched **`@ai-sdk/harness-codex` 1.0.29** and **`@ai-sdk/harness-opencode` 1.0.28**. Researchers said the findings show that the main risk lies in insecure agent orchestration and tool-execution logic, not prompt injection alone, with Google ADK also exposed to abuse that could write and run malicious Python code and leak API keys or cloud service account credentials.
Aug 6, 2026