Anthropic, OpenAI, and Google: The Flaws of LLM APIs Exposed

⚡

Key Takeaways

1Researchers discovered that the LLM models from Anthropic, OpenAI, and Google used the same encryption key for their reasoning blocks.

2This vulnerability allowed attackers to bypass the protections of weaker models to access unencrypted reasoning.

3The providers fixed the flaw after being informed, making similar attacks impossible.

💡Why it matters — This discovery highlights potential vulnerabilities in the security of AI models, emphasizing the need to strengthen encryption protocols.

The Vulnerabilities of LLM APIs from Tech Giants

Companies Anthropic, OpenAI, and Google have faced a troubling discovery regarding their advanced language models. These models, when used by clients, return encrypted reasoning blocks. These blocks can be replayed across different sessions, users, and models, allowing researchers to bypass the protections of weaker models to access the hidden reasoning of more powerful ones.

An example of these encrypted blocks can be observed by executing a specific command on OpenAI's API with the model 'gpt-5.6-luna'. This command allows the model to solve a complex mathematical problem and includes an option to retrieve the encrypted content of the reasoning.

The Vulnerability of Encryption Keys

Researchers discovered that all models within the same family used an identical encryption key. This flaw allowed the encrypted blocks to be sent to the weaker models in the family, thereby circumventing their protections to obtain the unencrypted raw reasoning. However, this vulnerability has been addressed after the providers were informed of the issue.

The Case of Claude Haiku 4.5

Among the models, Claude Haiku 4.5 proved particularly vulnerable. Researchers used a specific prompt to extract the reasoning attached to a conversational turn. They defined a turn prefix of <thinking-copy> to facilitate this extraction. This method was made possible by a feature that has since been removed in later versions of the model, but which still functioned in Haiku 4.5.

Reasoning Traces Not Intended for Humans

The researchers' article includes examples of reasoning traces they managed to extract. These traces provide insight into the raw thought processes of proprietary models, which are clearly not designed to be understood by humans. For instance, an excerpt from the GPT-5.5 model shows a reflection on CSS code, revealing needs and design decisions that are not intended for human consumption.

A New Form of Prompt Injection

Researchers also highlighted a variant of prompt injection, where a model is tricked into exfiltrating data as part of its thought trace. This method involves sending the encrypted thought trace into another model, exploiting the fact that models treat their own reasoning as high-priority instructions.

Timeline of Recent Events

August 7, 2026: OpenAI incident with Hugging Face
August 5, 2026: Use of Claude Fable 5 for a flight game
August 4, 2026: Launch of a new version of LLM with support for reasoning traces, OpenAI responses, server-side tools, and smarter logging

This article was originally published on August 11, 2026 by Simon Willison.