Researchers extract hidden secrets from LLM reasoning traces
6,708 agent sessions leaked 315K reasoning blocks containing real API keys and passwords
A new security research paper demonstrates how proprietary LLM APIs from OpenAI, Anthropic, and Google inadvertently leak sensitive data through hidden reasoning traces embedded in responses. The team analyzed 6,708 publicly available agent trajectories—generated by Claude, GPT, and Gemini models—finding that 315,320 reconstructed reasoning blocks contained encrypted but recoverable secrets.
By decoding these hidden blocks, researchers extracted 704 distinct privacy artifacts, including 62 API keys, 33 passwords, 24 access tokens, and 30 personal email addresses. Notably, 64 of these artifacts appeared exclusively within reasoning blocks, never surfacing in visible session data. The attack leverages the mismatch between API-reported token counts and actual hidden computation, allowing adversaries to reconstruct intermediate reasoning steps that often contain credentials, configuration details, or other sensitive information accidentally included by developers.
- Researchers recovered 315K reasoning blocks from 6,708 agent trajectories across OpenAI, Anthropic, and Google models, extracting 704 privacy artifacts including 62 API keys and 33 passwords
- 64 secrets were found exclusively in hidden reasoning traces, never appearing in visible session data, exploiting API-reported token counts vs. actual hidden computation
- Attack works by decoding encrypted reasoning blocks in public agent trajectories, revealing hardcoded credentials, tokens, and configuration details from real-world deployments
Why It Matters
Exposes a critical blind spot in LLM security where proprietary models unintentionally leak sensitive data through intermediate computation, risking credential theft and system compromise