Community Trust ScoreVerified
Security researchers cracked open a nasty hole in how major AI companies handle encrypted reasoning. The result: 62 live API keys and 33 passwords pulled straight from publicly shared session logs sitting on the open internet.
The paper dropped August 10. A team spanning MATS Research, the ELLIS Institute Tübingen, the Max Planck Institute for Intelligent Systems, and security firm Snyk put it together. Their targets were reasoning models from Anthropic, OpenAI, and Google — specifically the internal chain-of-thought process these companies encrypt to protect both intellectual property and user data. The encryption was supposed to be the wall. It wasn’t.
The core problem is almost embarrassingly simple.
One Key, Every Model, One Giant Problem
These companies use a single encryption key across their entire platform. Every model, every session. That means an encrypted reasoning block produced by a powerful model — say, Anthropic’s Claude Opus 4.8 — can be handed off to a weaker model in the same family, like Claude Haiku 4.5, and decoded there. No direct hack needed. No special permissions. Just standard API access and the architectural flaw does the rest.
The researchers didn’t just theorize it. They ran it. They pulled reasoning blocks from publicly shared AI agent transcripts on GitHub and Hugging Face. The final count: 315,320 reasoning blocks decoded from 6,708 transcripts. Inside those blocks, buried where nobody was supposed to look, were credentials, private data, and proprietary reasoning patterns that were never meant to leave the encrypted layer.
Sixty-two live API keys. Thirty-three passwords. Out in the open.
And the credential leak is probably the least scary part.
What the Flaw Actually Enables
Credential theft gets the headlines, but the researchers laid out a wider threat picture. The exploit can be used to steal proprietary reasoning patterns — the actual decision-making logic that AI companies spend enormous resources developing. Smaller models can study those decoded outputs and learn to mimic them, basically getting a shortcut to sophisticated reasoning without building it from scratch. That’s a direct competitive threat to any company whose reasoning process has commercial value.
Then there’s invisible prompt injection. Malicious instructions can be embedded inside encrypted reasoning blocks in a way that standard security monitoring tools won’t catch. The AI model gets manipulated. Nobody sees it happening. That’s a different category of risk entirely — it’s not about stealing data, it’s about controlling behavior without detection.
The researchers also flagged something specific about billing. Reasoning token counts matched billed API thinking tokens 1:1 for most prompts. That’s a pretty precise finding. It means the exploit isn’t hitting some edge case or obscure corner of the system — it’s running clean against the core billing infrastructure, which tells you how deeply the single-key architecture is baked in.
Developers make the exposure worse without knowing it. Session logs get posted to GitHub and Hugging Face constantly — for debugging, for collaboration, for sharing work. Most developers posting those logs have no idea sensitive information is sitting inside the encrypted reasoning blocks. They can’t see it. They don’t know it’s there. But someone running this exploit can pull it right out.
Anthropic, OpenAI, and Google all pushed server-side patches after the researchers followed responsible disclosure procedures. That part worked as it should.
But here’s what didn’t get fixed.
Patches Are Live — the Logs Aren’t Gone
The 6,708 transcripts the researchers decoded? Still publicly accessible. The reasoning blocks inside them? Still decoded. The patches stop new exploitation going forward, but they can’t reach back and scrub what’s already out there. Those logs live in public repositories, and the data inside them stays available to anyone capable of running the same attack.
None of the three companies — Anthropic, OpenAI, Google — have said what, if anything, they plan to do about the already-exposed session transcripts. No public statement on takedowns, no coordinated effort to flag affected repositories, no guidance to developers on what to check. Unclear whether anything is coming.
The architectural issue the paper identifies isn’t a bug someone forgot to patch. It’s a design choice — using one encryption key across all sessions and models within a provider’s ecosystem. That choice made the whole thing possible. Fixing it going forward is one thing. The 315,320 already-decoded reasoning blocks sitting in public repos are a separate problem, and right now there’s no answer for them.
The paper was submitted August 10.
Frequently Asked Questions
What encryption flaw did researchers find in AI reasoning models?
Researchers found that Anthropic, OpenAI, and Google use a single encryption key across all models and sessions, allowing encrypted reasoning blocks from powerful models like Claude Opus 4.8 to be decoded by weaker models like Claude Haiku 4.5 using only standard API access.
How many credentials were exposed in the AI reasoning exploit?
The researchers decoded 315,320 reasoning blocks from 6,708 publicly shared transcripts, uncovering 62 live API keys and 33 passwords buried in the encrypted data.
