AI推理外洩評測：OpenAI、Anthropic、Google加密CoT破解 | AI Reasoning Leak Review: OpenAI, Anthropic, Google Flaw
By Kit 小克 | AI Tool Observer | 2026-08-20
🇹🇼 AI推理外洩評測：OpenAI、Anthropic、Google加密CoT破解
AI推理外洩成了本週資安圈最熱話題：研究人員證實 OpenAI、Anthropic、Google 三大廠的加密推理過程（CoT，Chain-of-Thought）其實可以跨模型、跨使用者、跨對話互通解密。換句話說，你以為「加密」的內部思考過程，其實可以被同廠牌裡較弱、防護較鬆的模型直接「翻譯」成明文——研究團隊光是從公開日誌裡就解出 31 萬多筆可利用的推理區塊，挖出 182 組 API 金鑰、密碼，以及 367 筆個資。
什麼是AI推理外洩漏洞？
簡單說，這三家廠商為了不讓使用者看到完整的思考過程（避免被複製、避免暴露安全機制），把 CoT 加密後才回傳。但研究發現，這些加密區塊是用「同一組全廠通用金鑰」加密，沒有綁定特定使用者、session 或模型版本，只要換一個同廠牌的模型去「讀」這段加密內容，就能把它解碼還原成明文推理過程。
駭客實際上怎麼利用？
研究團隊示範了四種濫用手法：
- 模型蒸餾竊取：把強模型的推理過程偷出來，拿去訓練自己的模型
- 竊取他人隱私：從別人公開分享的 agent log 裡解出個資、密碼
- 還原「表面安全」的答案：模型表面上回答得很安全，但推理過程裡藏著沒過濾的敏感內容
- 藏匿提示注入（prompt injection）：把惡意指令埋進加密推理區塊裡，繞過偵測
外洩了什麼資料？
研究人員分析超過 31 萬筆從 GitHub、論壇等公開 agent log 裡蒐集到的推理區塊，成功解出 182 組可用憑證（API 金鑰、密碼、access token、私鑰）和 367 筆個資。這些資料原本只存在「內部推理」裡，從未出現在使用者看得到的正式回答中，所以開發者根本不知道自己貼出去的 log 裡藏著機密。
廠商怎麼回應？
OpenAI、Anthropic、Google 在收到通報後都已部署伺服器端修補，研究團隊表示目前主要的攻擊手法已經無法在最新版 API 上重現。不過論文也提醒，加密機制的根本問題——用全廠通用金鑰而非綁定使用者/模型——尚未完全解決，長期風險仍在。
開發者該怎麼防範？
- 別再把完整 agent log（含推理過程）貼到公開 repo 或論壇求助
- 檢查過去是否曾公開分享過含推理內容的 log，若有就假設憑證已外洩，立即輪替
- 對 agent 生成的憑證、密碼採最小權限與短時效原則，就算外洩也降低傷害
- 持續關注廠商的安全公告，這類「加密但沒綁定」的架構問題可能還會出現在其他地方
常見問題 FAQ
Q：一般開發者現在還有風險嗎？
三家廠商都已修補主要攻擊手法，但如果你過去曾公開分享過 agent log，裡面的憑證仍應視為已外洩，建議直接輪替。
Q：這跟一般的 API 金鑰外洩有什麼不同？
差別在於資料藏在「你以為加密看不到」的推理過程裡，開發者往往不知道自己貼出去的內容含有機密，防範意識比一般金鑰外洩更低。
Q：Claude、GPT 用的加密推理還安全嗎？
目前已知的跨模型解碼手法已被廠商擋下，但根本的「全廠通用金鑰」設計問題仍存在，建議持續留意後續研究與公告。
好不好用，試了才知道。
🇺🇸 AI Reasoning Leak Review: OpenAI, Anthropic, Google Flaw
AI reasoning leak is the security story dominating headlines this week: researchers confirmed that the encrypted chain-of-thought (CoT) used by OpenAI, Anthropic, and Google can be decoded across models, users, and sessions within the same provider. The "encrypted" internal reasoning you assumed was hidden can actually be handed to a weaker, less-guarded model from the same vendor and read back out in plaintext. Researchers pulled over 315,000 exploitable reasoning blocks from public logs and recovered 182 credentials and 367 pieces of PII.
What Is the AI Reasoning Leak Flaw?
To stop users from seeing full model reasoning (to prevent copying or exposing safety logic), providers encrypt CoT before returning it. The catch: these blocks are encrypted with a single, provider-wide key — not bound to a specific user, session, or model tier — so feeding a strong model's encrypted trace to a weaker sibling model lets it "translate" the block back into plaintext.
How Are Attackers Exploiting It?
- Model distillation theft — stealing a flagship model's reasoning to train a competing model
- Cross-user data theft — decoding credentials and PII from other users' publicly shared agent logs
- Recovering unfiltered content — pulling sensitive material hidden behind an outwardly "safe" answer
- Hiding prompt injection — burying malicious instructions inside opaque reasoning blocks to dodge detection
What Data Was Exposed?
Researchers analyzed 315,320 reasoning blocks scraped from public agent logs on GitHub and forums, decoding 182 usable credentials (API keys, passwords, access tokens, private keys) and 367 PII artifacts. None of this data was ever visible in the assistant's rendered answer — it lived only inside the internal reasoning, so developers had no idea their published logs contained secrets.
How Did the Providers Respond?
OpenAI, Anthropic, and Google all acknowledged the report and shipped server-side mitigations; the researchers say the primary cross-model extraction technique is no longer reproducible on current API builds. The paper notes, though, that the underlying design flaw — a global key instead of per-user or per-model binding — hasn't been fully resolved, so long-term risk remains.
How Should Developers Protect Themselves?
- Stop pasting full agent logs (including reasoning traces) into public repos or forum posts when asking for help
- Check whether you've ever shared logs containing reasoning content — if so, treat any credentials in them as compromised and rotate immediately
- Use least-privilege, short-lived credentials for anything an agent handles, so a leak does less damage
- Watch vendor security advisories — this "encrypted but not bound" pattern could resurface elsewhere
FAQ
Q: Am I still at risk as a regular developer?
The main cross-model extraction technique is patched, but any credentials in agent logs you've publicly shared in the past should still be treated as leaked — rotate them now.
Q: How is this different from a normal API key leak?
The secrets were hidden inside reasoning you assumed was encrypted and unreadable, so developers had no reason to suspect their published content contained anything sensitive.
Q: Is encrypted reasoning in Claude or GPT safe now?
The known cross-model decoding technique is blocked, but the root cause — a provider-wide encryption key — hasn't been fully redesigned, so keep an eye on follow-up research.
好不好用，試了才知道。（Works or not — you won't know till you try it.）
Sources / 資料來源
- The Hacker News: OpenAI, Anthropic, Google API Flaw Let Weaker AI Models Decode Stronger Models' Reasoning
- arXiv: Stealing Reasoning Traces from Proprietary LLM APIs
- explainx.ai: Encrypted CoT Flaw — 182 Credentials Leaked from Public Logs
常見問題 FAQ
一般開發者現在還有風險嗎？
三家廠商都已修補主要攻擊手法，但如果你過去曾公開分享過 agent log，裡面的憑證仍應視為已外洩，建議直接輪替。
這跟一般的 API 金鑰外洩有什麼不同？
差別在於資料藏在「你以為加密看不到」的推理過程裡，開發者往往不知道自己貼出去的內容含有機密，防範意識比一般金鑰外洩更低。
Claude、GPT 用的加密推理還安全嗎？
目前已知的跨模型解碼手法已被廠商擋下，但根本的「全廠通用金鑰」設計問題仍存在，建議持續留意後續研究與公告。
延伸閱讀 / Related Articles
- GPT-5.6-Cyber評測：OpenAI攻擊級駭客模型上線 | GPT-5.6-Cyber Review: OpenAI Ships Offense-Grade Hacking AI
- Unitree宇樹機器人上市評測：首日暴漲629%人形機器人第一股 | Unitree Robotics IPO Review: Humanoid Robot Stock Soars 629% on Debut
- Mercor評測：AI資料標注新創估值半年翻倍衝200億 | Mercor Review: AI Data Labeling Startup Doubles to $20B
AI 工具觀察站 — 每日精選 AI Agent 與工具趨勢
AI Tool Observer — Daily curated AI Agent & tool trends
留言
張貼留言