In brief
- A team or researchers found that Anthropic, OpenAI, and Google all use a single global encryption key for AI reasoning tokens.
- By decoding 315,320 reasoning blocks scraped from public GitHub and Hugging Face repositories, the researchers recovered 182 credentials, including 62 live API keys, 33 passwords, and 30 personal email addresses.
- OpenAI, Anthropic, and Google deployed server-side patches after responsible disclosure, but historical session logs already shared publicly remain decodable.
Security researchers have found a way to read the encrypted "inner thoughts" of every major AI reasoning model—and uncovered 62 live API keys and 33 passwords buried in session logs that developers had shared publicly online without knowing what was inside them.
“By decoding 315,320 reasoning blocks scraped from public repositories, we recovered 367 Personally Identifiable Information (PII) artifacts and 182 credentials,” the researchers wrote.
The paper, submitted August 10 by a team from MATS Research, the ELLIS Institute Tübingen, the Max Planck Institute for Intelligent Systems, and security firm Snyk, targets a specific class of AI: reasoning models. These are models that don't just answer immediately and instead start with an internal chain-of-thought (a step-by-step scratchpad where the AI works through a problem before showing you the answer), then deliver a final response.
Anthropic, OpenAI, and Google all encrypt that hidden scratchpad. Encryption—the process of scrambling data into an unreadable code—is meant to protect the company's intellectual property and keep sensitive intermediate reasoning away from users. The encrypted block gets passed back to the provider's servers with every follow-up message, maintaining the conversation without storing anything on the company's end.
One key to rule them all
The flaw is architectural. Instead of binding each encrypted reasoning block to a specific user, session, or model, all three providers use a single, provider-wide encryption key across their entire ecosystem. "These encrypted blocks are fully compatible and interchangeable across different sessions, users, and even different models within a provider's ecosystem," the researchers wrote.
That means a block of encrypted reasoning from Claude Opus 4.8—Anthropic's flagship model—can be injected into Claude Haiku 4.5, a cheaper, less guarded sibling without breaking Anthropic’s rules. Haiku lacks the anti-distillation alignment (safety training specifically designed to stop a model from transcribing its own reasoning on command) that Opus has.
Tell Haiku to read out the encrypted block verbatim, and it does. "By injecting an encrypted reasoning trace from a given model into a weaker, and less safeguarded model from the same provider, we force it to decode and output the trace verbatim in plaintext, without ever jailbreaking the more capable model directly," the paper states.
"Cross-model portability means Haiku 4.5 can read Opus 4.8's thoughts," lead researcher Alexander Panfilov wrote on X. The same attack reproduced across OpenAI's GPT-5.6 family and Google's Gemini model lineup. No special access required—standard API access (the connection developers use to build applications on top of AI models) was sufficient to execute it.
