Summary
- A group of researchers discovered that Anthropic, OpenAI, and Google utilize a common global encryption key for AI reasoning tokens.
- By analyzing 315,320 reasoning blocks sourced from public GitHub and Hugging Face repositories, they managed to retrieve 182 credentials, which included 62 active API keys, 33 passwords, and 30 personal email addresses.
- After the responsible disclosure, OpenAI, Anthropic, and Google implemented server-side patches, yet previously shared session logs remain accessible for decoding.
A team of security researchers has successfully accessed the encrypted "inner thoughts" of all major AI reasoning models, uncovering 62 active API keys and 33 passwords hidden in session logs that developers had unintentionally shared online.
“Through the decoding of 315,320 reasoning blocks obtained from public repositories, we unearthed 367 Personally Identifiable Information (PII) artifacts and 182 credentials,” the researchers stated.
The research paper, submitted on August 10 by a collaborative team from MATS Research, the ELLIS Institute Tübingen, the Max Planck Institute for Intelligent Systems, and the security firm Snyk, focuses on a specific category of AI known as reasoning models. These models engage in a thought process before arriving at an answer, using an internal chain-of-thought mechanism that serves as a step-by-step scratchpad.
Anthropic, OpenAI, and Google encrypt this internal reasoning process. The purpose of this encryption—transforming data into an unreadable format—is to safeguard the intellectual property of the companies and to keep sensitive intermediate reasoning hidden from users. Each encrypted block is sent back to the provider's servers with every follow-up message, ensuring the conversation continues without storing data on the company's servers.
Universal Encryption Key Issue
The vulnerability lies in the architecture itself. Instead of associating each encrypted reasoning block with a specific user, session, or model, all three companies employ a single encryption key that is applicable across their entire systems. “These encrypted blocks are fully compatible and interchangeable across different sessions, users, and even different models within a provider's ecosystem,” the researchers explained.
This means that an encrypted reasoning block from Claude Opus 4.8—Anthropic's leading model—can be injected into Claude Haiku 4.5, a less secure, more affordable variant without violating Anthropic’s guidelines. Haiku does not have the anti-distillation alignment (safety measures designed to prevent a model from revealing its own reasoning) that Opus possesses.
Instruct Haiku to read the encrypted block, and it will do so verbatim. “By injecting an encrypted reasoning trace from a given model into a weaker, less protected model from the same provider, we compel it to decode and present the trace in plaintext without directly compromising the more advanced model,” the paper asserts.
“Cross-model compatibility allows Haiku 4.5 to interpret Opus 4.8's reasoning,” lead researcher Alexander Panfilov noted on X. This vulnerability is replicable across OpenAI's GPT-5.6 family and Google's Gemini models, requiring only standard API access to execute.
We can finally discuss this:
We discovered a method for extracting hidden reasoning from leading models using a vulnerability in the APIs of every major AI company.
Our token count for reasoning matches the billed API thinking tokens 1:1 for most of the queries we tested. pic.twitter.com/S7wN8aP3X7
— Alexander Panfilov (@kotekjedi_ml) August 11, 2026
Contents of the Public Logs
To highlight the actual risks, the team collected 6,708 AI agent transcripts—automated session logs that developers commonly post to GitHub and Hugging Face for collaboration or debugging purposes. They successfully decoded 315,320 reasoning blocks from these logs.
"Developers often share their session logs and encrypted reasoning traces online, completely unaware of the sensitive information concealed within the encrypted blocks,” the paper emphasizes. Many of these secrets were not visible in the AI's outputs; they existed solely within the encrypted reasoning, undetectable to anyone who had not performed the attack.
This vulnerability creates four potential attack paths beyond mere credential theft: extracting proprietary reasoning patterns from AI companies to train competing models via distillation (where a smaller AI learns to replicate a larger one by analyzing its outputs); retrieving private information from shared logs; executing invisible prompt injections, where harmful instructions are hidden within encrypted reasoning blocks that security monitoring tools cannot detect; and jailbreaking advanced models by exploiting their less secure counterparts.
Following responsible disclosure, Anthropic, OpenAI, and Google have all implemented server-side mitigations. As previously reported by Decrypt, Anthropic has been a frequent target for security researchers this year, particularly as its latest models consume significantly more tokens in the process.
The patches are now active, but the 6,708 session transcripts containing decoded reasoning blocks that have been scraped from the public web remain accessible.