Key facts
- A flaw in AI reasoning models from Anthropic, OpenAI, and Google allows encrypted 'inner thoughts' to be decoded.
- Researchers recovered 182 credentials, including 62 live API keys and 33 passwords, from public session logs.
- The vulnerability arises from a single, provider-wide encryption key used across AI ecosystems.
- This allows weaker models to reveal the reasoning of more capable models from the same provider.
- Anthropic, OpenAI, and Google have implemented server-side patches to address the vulnerability.
Security researchers have uncovered a significant vulnerability in major AI reasoning models, allowing them to access encrypted internal thought processes and extract sensitive credentials. A team from MATS Research, the ELLIS Institute Tübingen, the Max Planck Institute for Intelligent Systems, and Snyk found that Anthropic, OpenAI, and Google all use a single, provider-wide encryption key for their AI reasoning tokens.
By decoding 315,320 reasoning blocks scraped from public GitHub and Hugging Face repositories, the researchers recovered 182 credentials, including 62 live API keys, 33 passwords, and 30 personal email addresses. The flaw lies in the architectural design where encrypted reasoning blocks are interchangeable across different sessions, users, and even models within a provider's ecosystem. This allows a weaker model, such as Anthropic's Haiku, to be prompted to reveal the plaintext reasoning of a more powerful model, like Opus, without directly attacking the stronger model.
Developers often share session logs publicly for collaboration or debugging, unaware of the sensitive data hidden within these encrypted blocks. The vulnerability enables several attack vectors, including stealing proprietary reasoning patterns for model distillation, extracting private data, executing hidden prompt injections, and jailbreaking powerful models through less-guarded counterparts. Following responsible disclosure, Anthropic, OpenAI, and Google have implemented server-side patches. However, the 6,708 session transcripts with already decoded reasoning blocks remain publicly accessible.