Major AI Model Flaw Let Weaker Models Decode Encrypted Reasoning, Exposing 62 API Keys and Passwords

OpenAI, Anthropic, Google API Flaw Let Weaker AI Models Decode Stronger Models' Reasoning

A newly disclosed flaw in the way OpenAI, Anthropic, and Google carried hidden AI reasoning between API calls let researchers recover internal reasoning and secrets from session logs, including API keys and passwords. The weakness affected encrypted reasoning objects used by the providers' reasoning APIs, where a block created in one session could be replayed into another and, during testing, even handed to a weaker model in the same provider family to make it reveal the hidden content. The team behind the paper Stealing Reasoning Traces from Proprietary LLM APIs demonstrated four abuse paths: stealing proprietary reasoning for model distillation, extracting private data from other users' published traces, recovering harmful content concealed behind a safe visible answer, and hiding prompt injections inside opaque reasoning blocks. Across 6,708 public agent trajectories, the team decoded 315,320 thinking blocks. After excluding benchmark sources, it counted 704 distinct privacy artifacts from genuine user sessions, including 62 API keys, 33 passwords, 24 access tokens, and seven private keys. The cross-user attack did not provide arbitrary access to private chats. It required obtaining an encrypted reasoning block, such as one published in an agent log, and API access to a compatible model from the same provider. The researchers disclosed the findings to the affected model providers, Microsoft and Hugging Face, and say the demonstrated attacks stopped working after mitigations. Their reproducibility statement says the main extraction attack is no longer reproducible as of August 2026. The report does not document malicious exploitation in the wild. Developers are advised to strip reasoning blocks and opaque reasoning fields from shared traces and avoid committing raw API transcripts even when the visible text has been sanitized. The problem starts with a design meant to preserve reasoning across API calls when conversation state is managed manually or statelessly. OpenAI can return encrypted reasoning items that applications replay with manually managed history, Anthropic carries full reasoning in an encrypted signature, and Google uses encrypted thought signatures. These objects preserve reasoning state without exposing the underlying plaintext directly to the client. The encryption itself was not cracked, and the attack did not require obtaining an encryption key. It relied on intact opaque blocks being accepted and processed by the provider. During testing, the paper found those objects portable across sessions, users, and models, allowing a weaker compatible model to act as what the authors call a "fuzzy" decoder: Claude Haiku 4.5 for Claude traces, GPT-5.6 Luna for GPT traces, and Gemini Robotics ER-1.6 for Gemini traces. The decoder was prompted to transcribe reasoning produced by a stronger model. That cross-user behavior turns published agent logs into the sharper security problem. Of the 704 non-benchmark artifacts the team recovered, 64 appeared only in hidden reasoning and nowhere in the visible trace. Sanitizing the readable conversation could therefore leave secrets inside an opaque block that another account was able to replay. The exposure the study demonstrates is bounded: it lands on developers who published raw agent logs with the reasoning objects intact, one identifiable group rather than every API user, and not necessarily the only one at risk. The same portability also enabled an invisible prompt-injection proof of concept. The team crafted an opaque reasoning block that carried a malicious instruction and later replayed it into an unrelated task, causing the receiving model to add an attacker-directed upload action without putting the injected instruction in visible text. The authors caution that they do not have ground-truth plaintext for the proprietary reasoning, so they cannot guarantee every reconstructed trace is an exact copy. Their fidelity checks relied on reasoning-token counts and qualitative comparisons, with extracted lengths generally tracking the providers' reported thinking-token counts. Current vendor documentation shows that encrypted reasoning remains part of these APIs, but handling has changed. OpenAI still tells developers to replay encrypted reasoning items when manually managing stateless history, while Google says its backend manages thought compatibility when a session switches models. Anthropic now says thinking blocks are tied to the model that produced them and should be stripped when switching models because other models ignore them. Several questions the disclosure raises are left open by the public record. No public acknowledgment of the flaw from any of the three providers has surfaced so far, and none has tied its current documentation to this research, so the account that the demonstrated attacks no longer work rests on the researchers' own reproducibility statement rather than on vendor confirmation. The same record shows the team decoded hundreds of thousands of reasoning blocks already sitting in public repositories, yet it does not address whether those already-published blocks remain decodable, a separate question from whether fresh attacks still succeed. The work builds on May research by Johns Hopkins cryptographer Matthew Green, who showed that encrypted reasoning blocks could be replayed across sessions and accounts but stopped short of a reliable secret-extraction technique. Green says he reported the replay behavior to OpenAI and Anthropic through their bug-bounty programs; in his account, OpenAI called the report unreproducible and Anthropic said it did not see security implications in the replay or side-channel behavior. The new paper turns that replay behavior into a broader extraction method and documents the privacy consequences at scale.

'Inner Thoughts' of Every Major AI Model Exposed in Massive Exploit

OpenAI, Anthropic, and Google deployed server-side patches after responsible disclosure, but historical session logs already shared publicly remain decodable. Security researchers have found a way to read the encrypted "inner thoughts" of every major AI reasoning model -- and uncovered 62 live API keys and 33 passwords buried in session logs that developers had shared publicly online without knowing what was inside them. "By decoding 315,320 reasoning blocks scraped from public repositories, we recovered 367 Personally Identifiable Information (PII) artifacts and 182 credentials," the researchers wrote. The paper, submitted August 10 by a team from MATS Research, the ELLIS Institute Tübingen, the Max Planck Institute for Intelligent Systems, and security firm Snyk, targets a specific class of AI: reasoning models. These are models that don't just answer immediately and instead start with an internal chain-of-thought (a step-by-step scratchpad where the AI works through a problem before showing you the answer), then deliver a final response. Anthropic, OpenAI, and Google all encrypt that hidden scratchpad. Encryption -- the process of scrambling data into an unreadable code -- is meant to protect the company's intellectual property and keep sensitive intermediate reasoning away from users. The encrypted block gets passed back to the provider's servers with every follow-up message, maintaining the conversation without storing anything on the company's end. One key to rule them all The flaw is architectural. Instead of binding each encrypted reasoning block to a specific user, session, or model, all three providers use a single, provider-wide encryption key across their entire ecosystem. "These encrypted blocks are fully compatible and interchangeable across different sessions, users, and even different models within a provider's ecosystem," the researchers wrote. That means a block of encrypted reasoning from Claude Opus 4.8 -- Anthropic's flagship model -- can be injected into Claude Haiku 4.5, a cheaper, less guarded sibling without breaking Anthropic's rules. Haiku lacks the anti-distillation alignment (safety training specifically designed to stop a model from transcribing its own reasoning on command) that Opus has. Tell Haiku to read out the encrypted block verbatim, and it does. "By injecting an encrypted reasoning trace from a given model into a weaker, and less safeguarded model from the same provider, we force it to decode and output the trace verbatim in plaintext, without ever jailbreaking the more capable model directly," the paper states. "Cross-model portability means Haiku 4.5 can read Opus 4.8's thoughts," lead researcher Alexander Panfilov wrote on X. The same attack reproduced across OpenAI's GPT-5.6 family and Google's Gemini model lineup. No special access required -- standard API access (the connection developers use to build applications on top of AI models) was sufficient to execute it. What the public logs contained To demonstrate real-world damage, the team scraped 6,708 publicly shared AI agent transcripts -- automated session logs that developers routinely post to GitHub and Hugging Face for collaboration or debugging. They decoded 315,320 reasoning blocks from those logs. "Developers frequently share their session logs and encrypted thinking traces publicly online, entirely unaware of the sensitive data hidden within the encrypted blocks," the paper notes. Most of those secrets never appeared in the visible AI output -- they existed only inside the encrypted reasoning, invisible to anyone who hadn't run the attack. The vulnerability opens four attack vectors beyond simple credential theft: stealing proprietary reasoning patterns from AI companies to train competing models via distillation (when a smaller AI learns to mimic a bigger one by studying its outputs); extracting private data from shared logs; executing invisible prompt injection, where malicious instructions are hidden inside encrypted reasoning blocks that security monitoring tools never see; and jailbreaking powerful models through their less-guarded siblings. Anthropic, OpenAI, and Google all deployed server-side mitigations after the team followed responsible disclosure procedures. As Decrypt previously reported, Anthropic has been a recurring focus for security researchers this year, especially as its latest models consume a lot more tokens in that process. The patches are live. The 6,708 session transcripts with decoded reasoning blocks already scraped from the public web are not going anywhere.