The rapid commercialization of reasoning-capable Large Language Models (LLMs) has introduced complex security paradigms across major artificial intelligence platforms. Recent independent security research into frontier models provided by OpenAI and Anthropic has brought to light distinct vulnerabilities and subtle side-channel leaks associated with encrypted reasoning blobs. These cryptographic and data-handling mechanisms, originally designed to preserve the integrity of a model’s hidden chain-of-thought (CoT) process, present unexpected security challenges that highlight the intersection of applied cryptography and machine learning infrastructure.
The investigation began as a routine hobby project exploring OpenClaw agent configurations paired with Anthropic’s Claude API. During the configuration process, an unexpected API error returned raw cryptographic messaging that included references to signed reasoning blocks. For researchers accustomed to cryptographic protocols, the presence of signature verification within an artificial intelligence model’s thinking block immediately signaled potential security implications. Tampering with these blocks reliably triggered stringent API rejection errors, confirming that the underlying data was actively authenticated and encrypted to prevent malicious modification during state transitions.
The Chronology of the Investigation
The exploratory project spanned roughly twenty hours of computational testing utilizing millions of development tokens. The inquiry systematically deconstructed how frontier LLM providers manage state across stateless API requests. In typical application architectures, especially those implementing zero-data retention or client-managed session loops, the client application must store and return conversation transcripts alongside hidden model metadata.
To maintain the continuity of a model’s internal monologue without retaining private chain-of-thought data on servers indefinitely, providers transmit an encrypted copy of the raw reasoning data back to the client. The client is instructed to treat this data as an opaque payload and return it unmodified on subsequent turns.
By closely examining the structure of these Base64-encoded JSON blobs, the researcher identified characteristics common to authenticated encryption standards, such as Fernet tokens or block cipher implementations utilizing Galois/Counter Mode (GCM). Despite these safeguards, further experimentation revealed significant systemic oversights in key management and session isolation.
Key Findings: Replay Attacks and Cross-Session Decryption
While direct bit-level tampering of the reasoning blocks consistently triggered server-side authentication rejections, unmodified blocks could be successfully replayed across entirely different contexts. Further testing demonstrated that reasoning blobs obtained from a session under one account could be successfully replayed into a completely separate session running under an entirely different user account. Furthermore, within OpenAI’s infrastructure, these reasoning blocks demonstrated cross-model replayability, allowing encrypted thoughts generated by one model version to be accepted by another.
This behavior strongly indicates the utilization of a single global cryptographic key across the provider’s infrastructure to encrypt and authenticate reasoning data sent to clients. For enterprises utilizing zero-data retention modes, this global key architecture implies that all customer reasoning data is effectively protected under a centralized, static key rather than isolated per-account keys.
Additionally, the research confirmed that these replayed blocks are not merely accepted by the cryptographic verification layer, but are occasionally "semantically active." When replayed into new conversations, models occasionally incorporated context from the hidden reasoning data of the previous session without direct prompting, demonstrating that the decrypted contents actively influenced the subsequent generation phase.
Side-Channel Vulnerabilities and Metadata Leakage
Beyond direct payload manipulation, the investigation explored whether metadata associated with reasoning blocks could leak confidential information. Because reasoning lengths fluctuate based on the complexity of the computational tasks assigned to the model, external observers can measure proxy signals such as token counts, encrypted block sizes, and wall-clock response times.
To test this potential side-channel, experiments were structured around conditional logic where a model was provided a secret instruction—such as a specific binary value—and instructed never to reveal it directly in its visible output. Although the model successfully suppressed the secret in its text response, the internal processing required to reason about the conditional logic created discernible variations in computational effort. These variations manifested as measurable differences in reasoning token counts and total response latencies.
By calibrating response times and block sizes across iterative trials, the methodology successfully classified hidden binary states, effectively establishing a side-channel leak. This proves that secret-dependent reasoning can inadvertently expose sensitive data through timing and token metrics, even when strict text-generation safety guardrails prevent the model from explicitly stating the information.
Platform Response and Industry Implications
The findings were formally reported to both OpenAI and Anthropic through their respective bug bounty programs. OpenAI initially classified the submission as unreproducible before subsequent data could be fully reviewed, while Anthropic concluded that the observed behavior regarding side-channels and replays did not constitute an immediate exploitable vulnerability. However, Anthropic indicated potential updates to developer documentation to advise application builders on rigorous input sanitization.
Security analysts emphasize that these findings point to broader structural challenges in LLM deployment. As reasoning models become increasingly autonomous, the data processed within hidden chain-of-thought tokens will likely encompass increasingly sensitive enterprise and platform data.
Mitigating these risks requires improvements on two distinct fronts. First, AI providers must enhance cryptographic key management by implementing granular, per-session, or per-account key rotation to eliminate the risks associated with global key escrow. Second, addressing side-channel leakage requires fundamental shifts in model architecture to prevent secret-dependent computational variations from escaping into observable metrics, a challenge complicated by the fact that automated policy enforcement mechanisms themselves rely heavily on computational reasoning.
