When AI companies introduced “encrypted reasoning,” it came with a reassuring pitch: the model’s chain-of-thought thinking would be locked away, invisible to users and protected from misuse. Businesses adopted AI tools with the assumption that internal reasoning was private.

Researchers just showed that assumption was wrong — and the implications for enterprise AI deployments matter even after the patch.

What the Researchers Found

Security researchers published findings this month demonstrating that encrypted reasoning blocks returned by the APIs of OpenAI, Anthropic, and Google could be replayed into weaker sibling models from the same provider. The technique extracted the “private” reasoning in plain text without breaking any cryptography directly.

The core flaw: all three providers used a single global encryption key for reasoning tokens across their model families. A reasoning trace generated by a flagship model could be dropped into a lighter model’s context, which treated it as a readable instruction and decoded its content.

The research paper, titled “Stealing Reasoning Traces from Proprietary LLM APIs,” documented four distinct abuse paths:

1. Model distillation theft. Competitor models (or adversarial researchers) could extract proprietary reasoning to replicate high-capability behavior without building or licensing it
2. Cross-user data extraction. Reasoning traces from one user’s session, if published in logs, could expose information from entirely different sessions
3. Hidden harmful content. Outputs blocked by a model’s safety filter in the visible response could be recovered from the reasoning trace
4. Prompt injection concealment. Malicious instructions could be hidden inside opaque reasoning blocks to evade detection tools

When the researchers scraped 315,320 reasoning blocks from public repositories (GitHub, Hugging Face, Pastebin), they found 367 items containing personally identifiable information and 182 exposed credentials — secrets developers had committed without realising they were embedded in the opaque reasoning fields attached to their code.

The Response

OpenAI, Anthropic, and Google each mitigated the demonstrated attack paths following responsible disclosure. The cross-session replay attack vector has been patched across all three providers.

None of the three companies provided public postmortem documentation on how widespread exposure was prior to the fix.

What This Means for Business

The patch addresses the specific technical exploit. What it does not resolve is the broader pattern this research exposes: enterprise teams are deploying AI tools based on trust in marketing language — “encrypted,” “hidden,” “protected” — without understanding what those terms actually guarantee at the infrastructure level.

Several things businesses should take from this:

“Encrypted” does not mean “inaccessible.” Encryption describes how data is stored, not who can access it or under what circumstances. In this case, the provider’s own infrastructure held the decryption key globally. Any model in the same provider’s ecosystem could act as a decoder.

Reasoning traces are logs, not scratch paper. When a model reasons through a task involving customer data, legal context, or financial details, that reasoning becomes a record. Businesses that pipe sensitive data through AI APIs need to treat reasoning traces with the same data classification policies they would apply to any other output.

Public repositories are the main exposure point. The bulk of the exposed credentials and PII were not leaked through a live attack — they were committed to public code repositories by developers who included API responses in their test fixtures, debug logs, or example outputs. The vulnerability compounded a pre-existing practice of treating AI output as inherently safe to publish.

Third-party integrations inherit the risk. Most enterprise AI deployments do not call provider APIs directly. They go through middleware platforms, workflow automation tools, and embedded integrations. Each layer potentially handles, logs, or stores reasoning traces without applying the same security scrutiny as the raw API call.

The Governance Gap This Exposes

This disclosure fits a pattern that has emerged across 2026 enterprise AI deployments: security assumptions lag capability adoption. When the Deloitte AI Institute surveyed enterprise leaders earlier this year, only 21% reported having a mature governance model in place for their AI systems. Capabilities are scaling; oversight is not. IBM’s 2026 Cost of a Data Breach report puts a number on the cost of that gap: AI-enabled breaches now average $6 million each, $1 million above the global average. The reasoning vulnerability is a concrete example of what that gap produces. An enterprise team that correctly vetted data handling at the model output layer had no reason to audit reasoning trace storage — that layer did not exist in their threat model.

Going forward, enterprise AI security reviews need to account for the full inference stack, not just inputs and outputs. That includes:

• How provider APIs handle intermediate computation states
• Whether reasoning tokens are cached, logged, or transmitted to third parties in provider infrastructure
• What a vendor’s key management practices are for any encrypted fields returned by their APIs
• Whether your internal tooling is publishing any AI response objects — including reasoning fields — to public or semi-public repositories

The Bigger Picture

AI security is not a checklist. It is an ongoing assessment of a system that providers update, researchers probe, and attackers observe continuously. The responsible disclosure here worked as intended — researchers reported, providers patched — but the window between discovery and patch is always real.

Businesses deploying AI at scale should be running their own periodic threat assessments, not relying on providers to inform them when something changes. The companies that found out about this flaw through their own monitoring programs had days to respond. The companies that found out from a news story did not.

---

What This Means for Business: Audit what your AI integrations are doing with reasoning fields. Check whether any developer tooling or CI pipelines are logging or publishing raw API responses. If you are handling sensitive data through AI APIs and have not reviewed your integration layer in the past six months, this is the moment to do it.

For businesses building AI-powered workflows with Omni Ops, Enterprise DNA’s deployment practice includes a security review of data flows and API integration points as part of the initial setup. Book a discovery call to talk through your current AI stack.