Hidden Reasoning Recovery and Cross-Session Messaging: New AI Agent Security and Collaboration Issues

The vulnerability stems from how hidden reasoning is handled. After a model completes internal reasoning, the API encrypts it into an opaque block and returns it to the client for storage. On subsequent calls, the client sends the block back, and the server validates and continues. Encrypted blocks are signed to prove they are untampered, but they are not always strictly bound to the original model, session, or account. Researchers found that some blocks can be loaded by a different model from the same provider. For example, a block generated by Anthropic's Opus model was accepted by Haiku, a smaller model, which then transcribed the contents. No server-side key was needed and no encryption was broken; the attack exploited missing context binding.

To confirm the recovered reasoning was genuine, researchers analyzed thinking token counts. They generated hidden reasoning from source models on 120 Codeforces problems and compared the API-reported hidden thinking token counts with the length of recovered text. Across multiple models from Anthropic, OpenAI, and Google, the recovered lengths closely matched the API-reported token numbers, with many samples near the y = x line. In a separate test, they collected 6,708 public agent trajectories from GitHub and Hugging Face, processing 315,320 reasoning blocks. Recovered outputs contained API keys, passwords, access tokens, private keys, email addresses, and internal technical information, some of which never appeared in the visible conversation history. This indicated the decoding model was not independently re-solving the problem but was reproducing hidden state.

The findings have significant consequences. Recovering reasoning in bulk could enable model distillation by using cheap compatible models to extract high-quality reasoning from expensive models, undermining the reasoning "moat" of closed-source vendors. Reasoning blocks also act as task state in agent systems, so malicious content hidden in them can serve as an invisible prompt injection. When a new agent loads old state, it may follow instructions that never appeared in visible user input. Agent security, therefore, must evolve from monitoring model outputs to managing the provenance, lifecycle, and permission boundaries of reasoning state.

Separately, Anthropic's new cross-session messaging for Claude Code lets multiple concurrent sessions communicate. According to the official documentation, the feature does not share conversation history or context windows; it transmits text messages containing task results and dependency information. Sessions register themselves on disk and bind to an inbox socket. Claude can list available agents and send messages to a named target. Local messages go directly through the socket without passing through Anthropic's servers, while remote sessions use server-based control. The feature is designed for parallel coding workflows where a database session can notify a backend session about schema changes, or a testing session can send regression results to a session that is modifying the relevant code.

The implementation respects session isolation and permissions. Messages from other sessions are treated as peer messages, not user instructions, and cannot approve permission prompts or modify configuration. If a user has denied an operation in one session, Claude cannot ask another session to perform it on its behalf. Inbound controls allow users to accept, hold, or refuse messages. If a target session is idle, a message can start a new turn; if it is active, the message waits until between tool calls. The system also has rate limits and buffer caps: up to 50 held messages per session and 100 in a separate hold buffer. Because the channel is not a reliable message queue, important facts should still be saved to durable storage.