Reasoning API Session Replay Flaw Exposes Model Internals and Secrets Across OpenAI, Anthropic, and Google

A vulnerability affecting the reasoning APIs of three major AI providers allows encrypted reasoning objects created in one session to be replayed into another, permitting researchers to recover sensitive internal data from session logs. The flaw stems from insufficient protection against replay attacks on encrypted reasoning state, a mechanism these providers use to preserve model reasoning between API calls without exposing it to users in plaintext.

The technical issue appears to centre on the serialisation and encryption of reasoning blocks. Researchers demonstrated that these encrypted objects lack session binding or nonce validation, meaning an attacker or insider with access to session logs can extract an encrypted reasoning block and inject it into a different session context where it decrypts successfully. During the researchers' testing, this led to recovery of API keys, passwords, and other secrets embedded within the model's internal reasoning traces. This represents a significant information disclosure risk: the reasoning layer was assumed to be opaque, but the weak replay protection creates a side channel that exposes what the model was actually computing.

The vulnerability affects users of all three providers who rely on reasoning APIs. The risk is heightened for organisations storing session logs or API request/response pairs, as any such logs become a potential source of leaked credentials and proprietary reasoning. The attack does not require breaking encryption; it only requires copying and replaying ciphertext, making it straightforward to execute with minimal technical sophistication once a session log is accessible.

Defenders should immediately audit session log retention policies and restrict access to API session data. Organisations should assume that any credentials, API keys, or sensitive data referenced during reasoning chains may have been exposed if logs were accessible to unauthorised personnel or stored insecurely. All API keys and passwords used in systems interfacing with these reasoning APIs should be rotated. Providers must patch by binding encrypted reasoning objects to session identifiers or adding tamper-evident nonces, ensuring replay is cryptographically impossible.

This incident highlights a broader risk in AI system design: reasoning and intermediate computation layers are often treated as black boxes whose contents are assumed safe from users, but they frequently contain sensitive data and should be protected with the same rigour as production credentials. The three-provider simultaneous discovery suggests this was a systematic architectural choice rather than an isolated implementation bug, raising questions about how many similar reasoning systems may have comparable weaknesses.