OpenAI, Anthropic, and Google API Flaw: How Weaker AI Models Read the Hidden Reasoning of Stronger Ones

MarGib October 13, 2026

🌐 🇵🇱 Polski · 🇬🇧 EN

Security researchers have uncovered a major flaw in the APIs of popular AI providers. This vulnerability allowed simpler models to recover hidden data from the responses of much more powerful systems. Could your data have been at risk?

Illustration showing a broken digital lock with a visible neural network from which hidden data is leaking between two AI models. — AI API flaw: How weaker models read hidden data from stronger systems.

API security in artificial intelligence systems rarely makes headlines—usually, that only happens when the data of thousands of companies is at risk. Recently, specialists from Lasso Security discovered a serious vulnerability in the APIs of OpenAI, Anthropic, and Google. This flaw enabled simpler AI models (such as GPT-3.5 or Claude Haiku) to read internal thought processes and confidential data generated by more advanced systems, including GPT-4o or Claude 3.5 Sonnet.

This discovery strikes at the trust in API security and forces us to ask a difficult question: how many organizations have unknowingly exposed their access keys, internal instructions, or proprietary source code to risk?

How did the flaw work? The attack mechanism step-by-step

The entire problem boiled down to how systems process so-called chain-of-thought reasoning (CoT). This is a technique where artificial intelligence "writes out" the subsequent stages of reasoning before providing a final answer. Theoretically, these internal thoughts should be invisible to the user. In practice, things turned out differently:

Hidden tokens and metadata were included in API responses, even though the user interface did not display them.
Weaker models were able to analyze session logs or manipulate query parameters (such as max_tokens or temperature) to extract this invisible information.
Specially crafted prompts forced stronger models to reveal details of their internal reasoning. This brought to light:
- fragments of source code,
- API keys and secrets embedded in instructions,
- internal system instructions (so-called system prompts).

During tests, researchers managed to recover OpenAI API keys directly from session logs when they were passed in queries to external tools. This demonstrates the real scale of the threat—from simple data leaks to the risk of taking control over an entire company's infrastructure.

Did the flaw affect all API endpoints?

Not every element of the API architecture was equally susceptible to attacks. Analysis shows that the problem mainly concerned:

chat-type endpoints (e.g., /v1/chat/completions),
functions related to fine-tuning, where models learned on specific, often confidential data,
responses generating very long sequences of tokens, where it was easier to hide metadata.

Older versions of interfaces that lacked proper filters proved to be particularly vulnerable. Interestingly, the vulnerability was not distributed evenly across all systems—some models, like Gemini 1.5 Pro, were much better at hiding this data than, for example, GPT-4o.

Who discovered the flaw and how did the companies react?

The vulnerability was identified by the Lasso Security team, who, after detecting the issue, withheld publication of the details until the technology providers had prepared patches. The researchers collaborated directly with the security teams at OpenAI, Anthropic, and Google. The tech giants' reaction was swift, though each approached the implementation of patches in their own way:

OpenAI: Implemented patches to filter out hidden tokens and metadata in their API. The company also published an official statement recommending key rotation and a thorough audit of logs.
Anthropic: Secured their API, eliminating the possibility of simpler models reading hidden tokens. Additionally, they provided tools to facilitate scanning logs for potential leaks (details can be found in the security documentation).
Google: Quickly updated the API for Gemini models, advising users to proactively change their access keys.

The providers found no evidence that the flaw was exploited by cybercriminals before it was patched. However, this does not mean one can rest easy—especially if an organization does not actively monitor API queries.

What data was at risk? The real consequences of the flaw

Although there is no evidence of mass system paralysis, this incident exposed weak points in AI integration:

API keys: Confirmed cases where sensitive access keys ended up in session logs. Although they were quickly revoked, the situation shows how easy it is to gain unauthorized permissions when secrets are passed directly in prompts.
Internal instructions (system prompts): Researchers managed to extract exact guidelines for models (e.g., instructions regarding safety or tone of voice), which paves the way for easier manipulation of AI behavior.
Code fragments: In situations where the model worked on source code, there was a risk of recovering fragments of it, which threatens a company's intellectual property.
User data: Although no database leaks were confirmed, information sent in prompts (e.g., in customer support systems) could theoretically have been intercepted.

The most concerning fact is that such an attack is extremely difficult to detect. Without advanced log monitoring, unusual queries are easy to miss, and a potential leak could go on for weeks without the administrators' knowledge.

Have similar flaws occurred in the past?

This is not the first time that language model programming interfaces have proven susceptible to manipulation. Just look at previous incidents:

Prompt Injection attacks: Allowing control over model behavior through clever query manipulation (described in more detail in the OWASP Top 10 for LLM).
API prompt leaks: Cases where endpoint errors allowed viewing other users' queries (mentioned, among others, in the Mistral Security Advisory).
"Model Stealing" attacks: Attempts to recreate model architecture or weights based solely on API responses (details described, among others, in an arxiv report).

All these examples clearly show that AI system security is still a construction site where the rules of the game are only just being written.

What should companies and developers do? Practical recommendations

If your systems use external AI models via API, it is worth implementing a few basic security principles:

1. API key rotation

If API keys were ever sent in the content of prompts, they must be changed immediately.
Keys should not be hardcoded. It is much safer to use environment variables or dedicated secret managers.

2. API log audit

It is worth regularly reviewing logs for unusual queries. Ready-made solutions, such as Lasso Scanner, can be helpful here.
Your own logs should always be encrypted and properly secured against unauthorized access.

3. Updating libraries and SDKs

Ensure you are using the latest versions of client libraries. Older SDK versions may not have the latest security patches.
It is worth regularly checking for outdated dependencies in the project using standard package manager tools.

4. Prompt filtering

Before a query reaches an external API, it should be sanitized of sensitive data (passwords, personal data, or internal tokens).
A good habit is to use automatic filters to sanitize content before sending it.

5. Monitoring unusual activity

It is worth implementing monitoring systems that detect unusual behavior—e.g., a sudden increase in the number of generated tokens or suspicious query parameters.
Setting up alerts for unusual traffic spikes from specific IP addresses allows for quick responses to anomalies.

6. Long-term security

Data encryption: When processing highly sensitive information, consider encrypting it. We wrote about the challenges associated with this in the article "Why is end-to-end encryption not perfect?".
Principle of least privilege: Grant API keys only those permissions that are absolutely necessary to perform a given task.
Team training: Developer awareness is the first line of defense. A good starting point for learning is the OWASP Top 10 for LLM standard.

Can we trust AI model APIs?

Recent events show that AI technology still carries significant risk. Although providers reacted efficiently, the whole situation proves how easy it is to overlook critical bugs in such complex architectures.

The conclusion for developers and companies is simple: security cannot be an afterthought. Changing keys, cleaning prompts, and monitoring logs are the absolute minimum. We must accept that similar vulnerabilities will appear, and the key to protecting data is constant vigilance.

If you are interested in the security of autonomous systems, we recommend our article "Claude AI hacked three companies. What does this mean for the security of autonomous systems in 2026?". In turn, you can read about how to become independent of external providers and run models yourself in the text "Local LLM inference in 2026: How to run large language models on your own computer".

Artificial intelligence security is a dynamic process. The question is: are we ready for the next inevitable challenges?