FINDING · EVALUATION
Researchers replayed opaque 'reasoning block' objects from 6,708 publicly posted LLM agent interaction traces against weaker models from the same AI provider, decoding 315,320 blocks and recovering 367 personally identifiable information items and 182 credentials; the attack demonstrates that scrubbing human-readable text from shared agent logs does not prevent leakage of secrets embedded in provider-internal API state objects.
From 2026-anon-vpn-ai-deepseek — 免费 VPN 扩展接管流量，AI 推理日志泄密：DeepSeek Harness、平台审计与数学进展周报 | 二毛 · §Agent日志泄密 · 2026 · ermao.net (Chinese-language circumvention blog)
Implications
- Circumvention tool developers using LLM APIs in operational tooling (configuration generation, threat analysis, or user support) must treat full raw API response objects—including reasoning, thinking, and signature fields—as confidential and strip them entirely before any log sharing, not just redact visible text.
- Audit any previously public agent traces or CI artifacts for API keys or proxy server credentials that may have been embedded in reasoning blocks, and rotate all credentials that appeared in any externally shared LLM interaction log.
Tags
Extracted by claude-sonnet-4-6 — review before relying.