A reasoning artifact is opaque model state that an AI service passes between API calls to preserve context. It may be encrypted, signed, or otherwise wrapped so the client can send it back unchanged. The artifact can carry hidden reasoning context, tool state, or session metadata without exposing its contents to the user.
In cyber security, reasoning artifacts matter because they behave like security-sensitive protocol data, not harmless output. If an attacker can replay one artifact into a different conversation or tenant, the system may accept the wrong state and leak internal traces or secrets. If logs capture these artifacts, telemetry can become an exposure path for API keys, passwords, or other credentials. Defenses include binding artifacts to the correct session, validating integrity, minimizing what gets stored, and redacting sensitive fields before logging. Treat them as part of the trust boundary, just like tokens or session cookies.