Security researchers have found a way to read the encrypted "inner thoughts" of every major AI reasoning model—and in the process uncovered 62 live API keys and 33 passwords buried in session logs that developers had shared publicly online without knowing what was inside them.

At the core of the findings is the discovery that Anthropic, OpenAI, and Google all use a single global encryption key for AI reasoning tokens. By decoding 315,320 reasoning blocks scraped from public GitHub and Hugging Face repositories, the researchers recovered 182 credentials, including 62 live API keys, 33 passwords, and 30 personal email addresses.

"By decoding 315,320 reasoning blocks scraped from public repositories, we recovered 367 Personally Identifiable Information (PII) artifacts and 182 credentials," the researchers wrote in their paper, submitted August 10 by a team from MATS Research, the ELLIS Institute Tübingen, the Max Planck Institute for Intelligent Systems, and security firm Snyk.

How the hidden scratchpad works

The research targets a specific class of AI: reasoning models. Rather than answering immediately, these models start with an internal chain-of-thought—a step-by-step scratchpad where the AI works through a problem before showing the answer—and only then deliver a final response. These models now sit at the center of coding assistants and autonomous agents that read files, run commands, and process real user data, which is how credentials and personal details can pass through the private scratchpad even when they never surface in the visible reply.

Anthropic, OpenAI, and Google all encrypt that hidden scratchpad. Encryption, the process of scrambling data into an unreadable code, is meant to protect the company's intellectual property and keep sensitive intermediate reasoning away from users. The encrypted block gets passed back to the provider's servers with every follow-up message, maintaining the conversation without storing anything on the company's end. Labs also monitor that hidden reasoning themselves as a safety check, watching chain-of-thought for signs that a model plans to break rules before an answer ever reaches users.

One key to rule them all

The flaw is architectural. Instead of binding each encrypted reasoning block to a specific user, session, or model, all three providers use a single, provider-wide encryption key across their entire ecosystem.

"These encrypted blocks are fully compatible and interchangeable across different sessions, users, and even different models within a provider's ecosystem," the researchers wrote.

That means a block of encrypted reasoning from Claude Opus 4.8, Anthropic's flagship model, can be injected into Claude Haiku 4.5, a cheaper and less guarded sibling, without breaking Anthropic's rules. Haiku lacks the anti-distillation alignment—safety training specifically designed to stop a model from transcribing its own reasoning on command—that Opus has.

Tell Haiku to read out the encrypted block verbatim, and it does.

"By injecting an encrypted reasoning trace from a given model into a weaker, and less safeguarded model from the same provider, we force it to decode and output the trace verbatim in plaintext, without ever jailbreaking the more capable model directly," the paper states.

"Cross-model portability means Haiku 4.5 can read Opus 4.8's thoughts," lead researcher Alexander Panfilov wrote on X.

The same attack reproduced across OpenAI's GPT-5.6 family and Google's Gemini model lineup. No special access was required—standard API access, the connection developers use to build applications on top of AI models, was sufficient to execute it.

We can finally talk about it: We found a way to extract hidden reasoning of frontier models using a vulnerability in the APIs of every frontier AI company. We verified that our reasoning token count matches billed API thinking tokens 1:1 for most of the prompts we queried. pic.twitter.com/S7wN8aP3X7 — Alexander Panfilov (@kotekjedi_ml) August 11, 2026

What the public logs contained

To demonstrate real-world damage, the team scraped 6,708 publicly shared AI agent transcripts—automated session logs that developers routinely post to GitHub and Hugging Face for collaboration or debugging—and decoded 315,320 reasoning blocks from them.

"Developers frequently share their session logs and encrypted thinking traces publicly online, entirely unaware of the sensitive data hidden within the encrypted blocks," the paper notes. Most of those secrets never appeared in the visible AI output; they existed only inside the encrypted reasoning, invisible to anyone who had not run the attack. Because the sensitive material sat inside encrypted blocks rather than in plain text, the automated secret-scanning services that platforms such as GitHub run across public repositories had no way to catch it—the standard safeguards that flag exposed API keys cannot see inside encrypted reasoning.

The vulnerability opens four attack vectors beyond simple credential theft:

• Stealing proprietary reasoning patterns from AI companies to train competing models via distillation, in which a smaller AI learns to mimic a bigger one by studying its outputs
• Extracting private data from shared logs
• Executing invisible prompt injection, where malicious instructions are hidden inside encrypted reasoning blocks that security monitoring tools never see
• Jailbreaking powerful models through their less-guarded siblings

Anthropic, OpenAI, and Google all deployed server-side mitigations after the team followed responsible disclosure procedures. As Decrypt previously reported, Anthropic has been a recurring focus for security researchers this year, especially as its latest models consume a lot more tokens in the reasoning process.

The patches are live—but the 6,708 session transcripts with decoded reasoning blocks already scraped from the public web are not going anywhere. For developers who have published agent transcripts, the standard response to this kind of exposure is to strip encrypted thinking blocks from shared logs and rotate any credentials that moved through those sessions.