Analysis · curated 26 Sep 2026
AI Agents Are Leaking Secrets Through Their Hidden Reasoning
First reported aydahwa.com
Coverage timeline
Single-source analysis — first reported, latest, and curated coincide.
Why it matters
Hidden reasoning traces in LLM agents can retain plaintext credentials and sensitive data that survive visible-output scrubbing, exposing organizations wiring agents into real workflows to inadvertent secret leakage.
A blog analysis from Aydahwa summarizes research titled "Stealing Reasoning Traces from Proprietary LLM APIs" in which researchers collected 6,708 publicly shared AI agent session logs from GitHub and Hugging Face, decoded the hidden/"encrypted" reasoning blocks, and recovered live API keys, passwords, access tokens, private keys, and personal email addresses that remained even after the visible text was scrubbed. The piece explains how hidden chain-of-thought reasoning traces retain secrets, tool outputs, and user data that operators never see and therefore fail to sanitize.