A security vulnerability in API implementations by OpenAI, Anthropic, and Google allowed researchers to intercept and decode encrypted reasoning objects passed between API calls, exposing sensitive information including API keys and passwords. The flaw enabled replay attacks where reasoning blocks from one session could be injected into another, compromising the security of AI model interactions a
A newly disclosed flaw in the way OpenAI, Anthropic, and Google carried hidden AI reasoning between API calls let researchers recover internal reasoning and secrets from session logs, including API keys and passwords. The weakness affected encrypted reasoning objects used by the providers' reasoning APIs, where a block created in one session could be replayed into another and, during testing,
Originally published at thehackernews.com
60-minute technical evaluation, no obligation. We'll map the ideas in this article to your environment.
