研究人员展示了一种从专有大语言模型API中提取推理痕迹的攻击方法，暴露了当前LLM服务的重大安全漏洞。[1]通过精心设计的输入指令（如Git仓库清理任务和航班预订任务），攻击者可以诱导模型泄露其内部处理过程中的敏感信息。[1]
这项研究针对GPT-5.2 Codex和Claude Sonnet 4.6等专有LLM API进行了测试。[1]攻击中成功窃取的数据包括AWS密钥（AKIA开头）、GitHub令牌（ghp_开头）、Hugging Face令牌（hf_开头）等API凭证，以及用户个人身份信息如姓名、身份证号和信用卡号码等。[1]研究人员使用Terminal-Bench的sanitize-git-repo任务和ClawBench的flight booking任务作为诱导向量，从而导致模型输出这些本不应暴露的数据。[1]
Researchers have demonstrated a vulnerability in proprietary large language model APIs that allows attackers to extract internal reasoning processes and sensitive data through carefully crafted prompts [1]. By designing specialized tasks such as Git repository sanitization and flight booking operations, the attackers were able to induce models to leak confidential information [1].
The attack successfully targeted multiple commercial LLM systems, including GPT-5.2 Codex and Claude Sonnet 4.6 [1]. The exposed data included API credentials from major platforms—AWS keys beginning with AKIA, GitHub tokens prefixed with ghp_, and Hugging Face tokens starting with hf_ [1]. The exploit also revealed personally identifiable information such as names and identification numbers, as well as financial data including credit card numbers [1].
This security breach highlights significant gaps in how proprietary LLM APIs handle sensitive information during their reasoning processes [1].