AI推理外洩評測：三大廠共用金鑰爆重大漏洞 | AI Reasoning Leak Review: One Shared Key Burns 3 Labs

By Kit 小克 | AI Tool Observer | 2026-08-31

🇹🇼 AI推理外洩評測：三大廠共用金鑰爆重大漏洞

AI推理外洩事件本週在資安圈炸鍋——OpenAI、Anthropic、Google 三大廠的推理（reasoning）API 被證實共用同一把全域加密金鑰，讓研究人員能從公開流出的對話紀錄裡，把模型「藏起來不給你看」的內部推理過程整段還原，甚至從中偷出夾帶的 API 金鑰與密碼。這不是釣魚或社交工程，是加密設計本身出了包。

AI推理外洩是怎麼被抓包的？

來自 ELLIS Institute Tübingen 與馬克斯普朗克智慧系統研究所的團隊，在 2026 年 8 月發表論文《Stealing Reasoning Traces from Proprietary LLM APIs》，把這個漏洞攤在陽光下。事情要從更早的 5 月說起：約翰霍普金斯密碼學者 Matthew Green 當時就已經回報三家廠商，推理區塊可以被「重播」到別的 session，但三家都回覆「沒有資安疑慮」。研究團隊接手後，把這個被忽視的重播漏洞做成了完整的資料竊取攻擊。

技術原理：一把鑰匙開所有的門

加密但不綁定身分：三家廠商都會把推理內容加密後夾在 API 回應裡，但加密金鑰是「全域共用」——不分使用者、不分 session、也不分同系列的模型版本。
推理區塊可跨模型重播：只要密文區塊完整，丟給同廠牌任何一個模型都吃得下去。
拿小模型當解碼器：研究人員直接叫 Claude Haiku 4.5、GPT-5.6 Luna、Gemini Robotics ER-1.6 這類輕量版模型，把大模型藏起來的推理內容「轉錄」出來——等於拿便宜模型當萬能鑰匙，破解貴的旗艦模型藏起來的思考過程。

AI推理外洩實際挖出多少東西？

研究團隊從 GitHub、Hugging Face 上開發者自己貼出來的公開 agent 紀錄下手，掃了 6,708 筆流出的對話軌跡，解出 315,320 個推理區塊，直接從真實使用者的 session 裡回收出 182 組可用憑證——包含 API 金鑰、密碼、存取權杖，外加數百筆個資。換句話說，這些外洩不是攻擊者主動入侵，而是開發者自己貼在網路上分享除錯紀錄時，順手把加密過的「機密」一起貼了出去，只是大家都以為那段加密內容看不到。

修補進度：攻擊已失效，但廠商沒正式承認

好消息是，研究團隊在論文裡註明，這次示範的萃取攻擊到 2026 年 8 月已經無法重現，代表三家廠商應該都已經在背後做了修補。壞消息是，OpenAI、Anthropic、Google 目前都沒有公開發過資安公告承認這個漏洞存在過，一般使用者只能靠研究論文才知道發生過什麼事。

對開發者的實際影響

如果你曾經把含有推理過程的 API 回應、debug log、agent 執行紀錄貼到公開 repo 或論壇，建議直接假設裡面的機密已經外洩，該撤銷輪替的金鑰立刻換掉。
之後分享 AI agent 除錯紀錄前，先把 reasoning/thinking 欄位整段拿掉，不要相信「反正是加密的」這種假設。
企業內部若習慣把完整 API 回應存進日誌系統，這次事件提醒該加一層自己的存取控制，不能只靠廠商的加密。

AI推理外洩這件事說穿了，是三大廠在衝推理能力的同時，把「加密」這個基本功課想得太簡單。好不好用，試了才知道。

🇺🇸 AI Reasoning Leak Review: One Shared Key Burns 3 Labs

This week's biggest AI security story is an AI reasoning leak that hit all three major labs at once: OpenAI, Anthropic, and Google were all using a single global encryption key to protect the hidden "reasoning" content inside their API responses — and researchers just proved they could reverse it, pulling raw chain-of-thought and embedded secrets straight out of public conversation logs. This isn't phishing or social engineering. It's a crypto design flaw baked into the product itself.

How the AI Reasoning Leak Was Discovered

A team from the ELLIS Institute Tübingen and the Max Planck Institute for Intelligent Systems published "Stealing Reasoning Traces from Proprietary LLM APIs" in August 2026. The story actually starts earlier: Johns Hopkins cryptographer Matthew Green flagged the underlying replay behavior to all three vendors back in May 2026. Their response at the time: "no security implications." The new paper turned that overlooked replay bug into a working, end-to-end extraction attack.

The Mechanism: One Key Opens Every Door

Encrypted but not session-bound: All three providers encrypt reasoning content in API responses, but the key is shared globally — not per user, not per session, not even per model version.
Cross-model replay: An intact encrypted reasoning block from one session can be fed to any model in the same provider family and it will happily process it.
Cheap models as decoders: Researchers prompted lightweight models — Claude Haiku 4.5, GPT-5.6 Luna, Gemini Robotics ER-1.6 — to simply "transcribe" reasoning that had been hidden by a much larger flagship model, effectively using a cheap model as a universal skeleton key for a far more expensive one.

The Numbers: How Much Actually Leaked

The team scraped 6,708 public agent trajectories that developers had voluntarily posted to GitHub and Hugging Face, decoded 315,320 reasoning blocks, and recovered 182 usable credentials — API keys, passwords, and access tokens — straight from real user sessions, plus hundreds of pieces of personal data. None of this required breaking into anything: developers had simply shared debug logs assuming the encrypted reasoning fields were unreadable.

Patch Status: Attack Dead, But No Official Acknowledgment

The good news: the paper notes the demonstrated extraction attack no longer works as of August 2026, implying all three vendors quietly patched something. The bad news: none of OpenAI, Anthropic, or Google has published a public security advisory confirming the flaw existed — so the only way most people will ever hear about this AI reasoning leak is through the research paper itself.

What This Means for Developers

If you've ever posted API responses, debug logs, or agent traces containing reasoning fields to a public repo or forum, assume any embedded secrets are already compromised — rotate those keys now.
Strip reasoning/thinking fields entirely before sharing agent debug output going forward. Don't assume "it's encrypted" means "it's safe to share."
If your org logs full API responses internally, this is a reminder to add your own access controls rather than relying solely on vendor-side encryption.

The takeaway from this AI reasoning leak: even the biggest labs can get the basics of crypto wrong while racing to ship reasoning features. 好不好用，試了才知道 — you won't know until you try it.

Sources / 資料來源

延伸閱讀 / Related Articles

AI 工具觀察站 — 每日精選 AI Agent 與工具趨勢
AI Tool Observer — Daily curated AI Agent & tool trends

Claude Code 實測：AI 幫你寫程式到底行不行？ | Claude Code Review: Can AI Really Code for You?

3月 26, 2026

閱讀完整內容

搜尋此網誌

AI小貼士