German researchers have discovered a critical security flaw affecting the AI models of the world's three largest providers. According to their study "Stealing Reasoning Traces from Proprietary LLM APIs," sensitive data such as passwords and API keys can be extracted from chatbot responses via a relatively simple workaround – despite encryption.
Key Facts
- Affected providers: Google (Gemini), OpenAI (ChatGPT), and Anthropic (Claude)
- Attack vector: So-called reasoning logs – encrypted character strings generated during complex reasoning tasks
- Core problem: Logs can be copied between models from the same company and decoded using manipulated versions
- Compromised data: Passwords, API keys, and other sensitive user information
How the Attack Works
For reasoning tasks that require extended thinking processes, all three AI systems output an encrypted reasoning log. This character string is sent back to the server with each new response to provide the AI with necessary context.
The researchers discovered that these logs can be extracted and used in other AI models from the same company. In concrete terms – a reasoning log from a newer OpenAI version also works in older OpenAI models. This alone would be manageable. The real problem emerges when these older or modified models have their security safeguards removed via jailbreak. Such a manipulated model can then be used to decode the encryption of the logs – exposing the sensitive data underneath.
Why This Is So Critical
The vulnerability doesn't just affect individual users. Companies integrating KI APIs into their systems could lose internal data, access keys, and business information through this attack vector. An attacker would only need access to an older or compromised model from the same provider – and could then decode logs from production systems.
The fact that all three market leaders are affected suggests this is a systemic problem in reasoning architecture, not an isolated case.
What This Means for You
If you're using AI models in your organization – whether as a developer, IT security professional, or decision-maker – take this vulnerability seriously. It's especially critical if you send sensitive data (customer information, internal processes, access keys) to AI APIs. The question isn't whether providers will fix the problem, but how quickly – and whether other exploitation methods exist in the meantime. It's worth reviewing your AI provider's security policies and potentially auditing which data really needs to go to external models.
Sources
Editorially owned by Ideal Syka. Sources and method: Newsroom & method. Tips and corrections: ai@i6eal.de.
