Researchers pulled Claude's, GPT's, and Gemini's hidden reasoning out in plain text
Eight researchers show that Anthropic, OpenAI, and Google each reuse one encryption key across their whole model family, letting a cheaper sibling model transcribe a flagship model's hidden reasoning back out in plain text.
Public logs already had passwords and API keys sitting inside reasoning blocks nobody thought to check.
AI providers encrypt a model's chain-of-thought reasoning before handing it back to the client that called the API, mostly so a conversation can hand off to a different model mid-session without losing its place. A paper posted to arXiv on August 10, 2026 shows that trade-off has a hole in it: every model in a provider's family authenticates against the same encryption key. Alexander Panfilov and seven co-authors, working out of the ELLIS Institute Tübingen and the Max Planck Institute for Intelligent Systems, captured an encrypted reasoning block from a flagship model, replayed it into a cheaper, less-guarded sibling model from the same provider, and jailbroke that weaker model into transcribing the flagship's private reasoning back out in plain text. It worked against Anthropic, OpenAI, and Google, without the researchers ever attacking the flagship model directly. Simon Willison and a long Hacker News thread picked it up the next day.
why reasoning gets encrypted in the first place
Providers do not keep a model's chain-of-thought reasoning server-side. They encrypt it and hand it back to the client, mainly so a conversation can switch models partway through without losing the reasoning that came before. That design choice is also the hole. The key that encrypts a session's reasoning is not tied to that one model, session, or user. It is shared across an entire model family, so a reasoning block produced by a provider's flagship model decrypts cleanly on its cheapest sibling too.
The attack never touches the flagship model. Capture the encrypted reasoning block a flagship model returns over the API, attach it as context to a call against a weaker model in the same family, and prompt that weaker model to continue and transcribe what it has been handed. The strong model's safety training and anti-distillation defenses never see the request, because the request never goes to the strong model.
four ways to abuse one key
- Bypass a provider's anti-distillation protections, the safeguards meant to stop a competitor from training a cheaper model on a flagship's reasoning.
- Pull personal data and credentials out of reasoning blocks at scale, from logs and repositories where developers pasted them without realizing what was inside.
- Surface hazardous information a model's safety training kept out of its visible answer but not out of its private reasoning.
- Hide a prompt injection payload inside a reasoning block, where the visible text looks clean but the model reads the injection anyway.
Coverage of this paper is not fully consistent on scale. An earlier post from one of the researchers described a preliminary scan of about 7,000 public reasoning traces that turned up 62 API keys, 33 email addresses, and 33 passwords. The paper's own abstract, covering the full study, cites 367 PII artifacts and 182 credentials pulled from 315,320 scraped reasoning blocks. Both figures trace back to the same research. We could not reconcile which one describes the final, complete result, so treat them as two different snapshots of the same project rather than a single confirmed count.
The researchers reported all of this to Anthropic, OpenAI, and Google before the paper went public on August 10, 2026. All three providers engaged with the report, and by the time of publication, the specific replay-and-jailbreak attacks no longer worked against the live systems.
we were unable to launch the same attacks
Why a build studio cares
This is not abstract for anyone building on these APIs. If a product logs reasoning traces for debugging, surfaces them in a visible thinking panel, or feeds transcripts into an eval pipeline, that pipeline was handling encrypted blocks that, until the patch, a weaker model elsewhere could have been made to read back in plain text. The fix on our side has nothing to do with the providers' patch: audit what your own build actually stores and displays from a reasoning trace, and treat that field as sensitive by default instead of assuming encryption already made it safe to log.
Next step: read the full paper for the cryptographic detail, or skim the Hacker News discussion for where practitioners think the fix should actually live. If you want a second pair of eyes on what your own product logs or displays from an AI provider's reasoning traces, write to us at hello@gattyworks.com.