研究人员发现可读取ChatGPT等模型加密推理过程的API漏洞

Core Highlights

Alexander Panfilov's team disclosed a vulnerability in the APIs of major AI providers—OpenAI, Anthropic, Google—that can expose the supposedly encrypted "thinking process" of reasoning models. Scanning about 7,000 public sessions, the team also dug up 62 API keys, 33 emails, and 33 passwords, making the exposure far broader than the models themselves. The finding matters because reasoning models are explicitly marketed as safer precisely because their intermediate steps are hidden from view. If that hiding fails, a core selling point collapses and the trust users placed in "private reasoning" turns out to have been misplaced from the very start of the engagement.

It also undercuts the marketing claim that reasoning models keep their intermediate work safely hidden from prying outside eyes.

What Happened

Reasoning models such as OpenAI's o-series and Claude Opus usually keep intermediate reasoning in encrypted fields, showing only the final answer on the front end to save tokens and reduce confusion. The researchers found that, through specific request constructions, this encrypted content can be decrypted and returned to the caller who asked for it. More strikingly, via jailbreaking, Anthropic's Haiku 4.5 could transcribe Opus 4.8's raw reasoning verbatim, effectively reading a sibling model's private chain of thought word for word. Moreover, keys and credentials leaked in public sessions escalated the risk from "model transparency" to "account security," since exposed API keys grant direct billing and data access to strangers who can run up charges or exfiltrate content at will without detection.

The team published only redacted excerpts, but the method is simple enough that other researchers will likely reproduce it quickly without help.

Technical Details

The root cause lies in insufficient access control over reasoning fields at the API layer: the encryption is more "front-end hiding" than true server-side secrecy that the server enforces regardless of what the client requests. Once a request is constructed to allow echoing internal traces, the server obediently sends them back, trusting the client not to ask for more than the UI shows. The team estimated that decoding 10,000 reasoning traces costs about $720 in API fees, proving such attacks are cost-feasible for almost any motivated actor with a credit card and a free weekend. The scanning method was batch-fetching publicly shared session links and embedded pages, a low-effort technique that nonetheless surfaced a trove of live secrets no one meant to publish to the open web.

Vendors have since begun reviewing whether their gateways strip reasoning fields by default rather than only when a client explicitly requests them.

Versus Competitors

This problem is not unique to one vendor. Any reasoning model using the "think first, answer later" paradigm faces the same risk as long as its intermediate state is exposed via the API in any reachable form. Closed-source vendors' supposed advantage is tighter server-side secrecy, yet this finding shows client-side hiding alone is far from enough to protect a claim of confidentiality. Compared with open-source setups that never expose reasoning traces in the first place, commercial APIs actually present a larger attack surface because they promise confidentiality they do not fully enforce. The lesson is that trust must be enforced server-side, not implied by the interface the user happens to see, or the promise is empty the moment someone probes it.

Open-weight models escape this particular leak because there is no hosted API surface to query for a hidden internal state at all.

Industry Impact and Use Cases

For developers, the immediate task is to rotate leaked keys and tighten session-sharing permissions before they are abused for billing fraud or data theft at scale. For vendors, reasoning encryption must be pushed down to enforced server-side secrecy, with separate trust boundaries for internal and external callers and no opt-out that leaks traces back to a requester. For enterprise compliance, this means bringing AI suppliers' API security into audit scope alongside ordinary third-party risk and contract language that actually specifies confidentiality. Simply put, when a model's "inner thoughts" can be bought and read for pocket change, so-called encrypted reasoning is little more than a sheet of paper over a window, and the industry needs to treat it as a real breach rather than a curiosity that merely proves a point about insecure defaults.

Expect a wave of bug-bounty programs specifically targeting reasoning-exposure endpoints at the major labs over the coming months.