A security flaw in AI encryption practices has exposed sensitive data, including API keys and passwords, across major models from Anthropic, OpenAI, and Google.
Security Researchers Uncover Major Vulnerability
A recent investigation by a team of security researchers has revealed a significant flaw in the encryption practices of leading AI companies, including Anthropic, OpenAI, and Google. The researchers found that these companies share a common global encryption key for AI reasoning tokens, which has led to the exposure of sensitive information.
Through their analysis of 315,320 reasoning blocks obtained from public GitHub and Hugging Face repositories, the team successfully retrieved 182 credentials. This included 62 active API keys, 33 passwords, and 30 personal email addresses, highlighting the risks associated with the developers' inadvertent sharing of session logs online.
“Through the decoding of 315,320 reasoning blocks obtained from public repositories, we unearthed 367 Personally Identifiable Information (PII) artifacts and 182 credentials,” stated the researchers.
Implications of Universal Encryption Key
The vulnerability stems from the architecture of the encryption systems used by these companies. Instead of assigning unique encryption keys to each user or session, a single key is employed across all models and sessions. This enables encrypted reasoning blocks to be interchangeable among different models, creating a potential security risk.
For instance, an encrypted block from Anthropic's Claude Opus 4.8 can be processed by a less secure model like Claude Haiku 4.5, which lacks the same safety measures. This means that if the weaker model is instructed to read the encrypted block, it can decode and present the information in plaintext.
“Cross-model compatibility allows Haiku 4.5 to interpret Opus 4.8's reasoning,” noted lead researcher Alexander Panfilov on X.
Real-World Risks and Future Actions
The researchers collected 6,708 AI agent transcripts, which are automated session logs often shared on public platforms for collaboration. They decoded 315,320 reasoning blocks from these logs, revealing that many sensitive data points were hidden within the encrypted reasoning and not visible in the AI's outputs.
This security flaw opens up multiple avenues for exploitation, including the potential for credential theft, unauthorized extraction of proprietary reasoning patterns, and the execution of hidden prompt injections that standard security measures may not detect.
In response to the findings, Anthropic, OpenAI, and Google have implemented server-side patches to address the vulnerability. However, the previously shared session logs containing sensitive information remain publicly accessible, posing ongoing risks.
Conclusion
This discovery underscores the necessity for AI developers to reassess their encryption strategies and implement more robust security measures to protect sensitive information from being inadvertently exposed.
