Researchers say inference traces from US frontier models can still be stolen via third-party cloud aggregators

The researchers audited OpenAI and Anthropic direct endpoints as well as downstream cloud aggregators such as AWS Bedrock, Microsoft Azure, and OpenRouter, and found that vendors' patches for inference trace extraction are fragmented and easily bypassed. Inference replay attacks remain intermittently effective on Azure against every OpenAI model (including GPT-6 Astra) and Anthropic models up to Sonnet 5, with a single decoding step recovering the trace verbatim; scratchpad attacks can still extract reasoning from all OpenAI models as well as Opus 4.8 and Sonnet 5, with only Opus 5, Fable 5, and Fable 5.1 not exposing reasoning. The authors point out that downstream hosts suffer from patch propagation delays and policy drift, and that attackers do not need to bypass the primary vendor guardrails—they only need to route requests to downstream hosts that have not synchronized protections. They recommend not authorizing cloud hosts that cannot synchronously enforce inference trace confidentiality and tool-scope guardrails.