Review opaque attachments
Remove hidden reasoning before sharing sensitive logs.
What this does—and does not—establish
Visible-text cleanup cannot inspect opaque content.
Security researchCASE STUDY / Public-log publishers
Shared AI logs revealed hidden sensitive material
Researchers report recovering sensitive material from hidden reasoning in publicly shared AI logs.
Source: Alexander Panfilov and coauthors / arXivExact scan dates undisclosed.
THE 10-SECOND TAKEAWAY
Hidden content can outlive visible cleanup.
HOW IT WORKED
Follow the chain.
Published logs
→
Researchers
SIMPLIFIED VIEW · 1 / 3STEP 01
Public logs
Researchers collected published agent sessions.
Alexander Panfilov and coauthors / arXivHidden block
→
Model
→
Readable text
SIMPLIFIED VIEW · 2 / 3STEP 02
Hidden contents
Models reproduced material concealed inside reasoning blocks.
Alexander Panfilov and coauthors / arXivDisclosure
→
Deletion
SIMPLIFIED VIEW · 3 / 3STEP 03
Disclose and delete
Findings were reported; recovered secrets deleted.
Alexander Panfilov and coauthors / arXivMove through the story at your own pace.
1 / 3
THINK OF IT THIS WAY
Editorial analogy: a document’s visible names are blacked out, but a sealed attachment still contains the originals—and another reader can open it.
An analogy for the mechanism; not an additional claim about the incident.KEEP THE EVIDENCE IN VIEW
What we know.
What we don’t.
Reported outcomes
Genuine user sessions contained credential and personal-information artifacts. Alexander Panfilov and coauthors / arXiv
Important limits
Benchmark examples include synthetic identities; counts are not victims.
Decoded text was not fully verifiable; successful use of recovered credentials was not established.
Public availability does not establish permission from every affected user.
The lesson beyond
this one case.
Editorial lesson: reviewing the visible text alone may miss material in attached data. Keep a clear distinction between exposure, a working credential, and someone actually using that credential.
What happened in response? +
Researchers disclosed findings and deleted recovered secrets; the same attacks subsequently failed. Alexander Panfilov and coauthors / arXiv
What could help
an organization?
Editorial defense mapping; not proof of prevention.
Coordinate disclosure
Notify providers and minimize retained sensitive material.
What this does—and does not—establish
Recovered strings do not prove account access.
Editorial connections to relevant controls, not evidence that a particular technology would have prevented this case. Each guide links to the security guidance behind its recommendations.
Explore the full AI security frameworkTRACE IT TO THE SOURCE
Read the evidence.
Explore more original accounts in the source report library ↗.
These are source-reported findings. An independent assessment, when available, is labeled explicitly.
01Stealing Reasoning Traces from Proprietary LLM APIsAlexander Panfilov and coauthors / arXiv · Aug 10, 2026 · primary security research paper
Read this case’s update history →
Reviewed Oct 1, 2026 · Editorial methodology · Structured data