Researchers crack encrypted AI reasoning, find passwords in leaked sessions

Security researchers led by Alexander Panfilov uncovered a vulnerability affecting the APIs of every major AI provider—OpenAI, Anthropic, and Google—that allows them to extract and read encrypted reasoning tokens generated by advanced reasoning models including OpenAI's o-series, Anthropic's Claude, and Google's Gemini. When these models work through complex tasks, they generate internal reasoning steps that providers encrypt to protect intellectual property and control how the model's thought process is perceived by users.

Panfilov's research team discovered that the encrypted reasoning processes are "fully portable across sessions, users, and models within a single provider." This portability creates a significant security flaw: a smaller, less capable model like Anthropic's Haiku 4.5 can be jailbroken to read and transcribe the raw thoughts of the more powerful Opus 4.8 without attacking Opus directly. The same vulnerability works with OpenAI and Gemini. The researchers confirmed that for most queries, the number of tokens they extracted matched the billed thinking tokens exactly, meaning they were capturing the full internal reasoning, not just fragments.

The security issue traces back to May, when cryptography expert Matthew Green discovered that encrypted reasoning blobs could be replayed outside their original context and reported it to the providers. According to Panfilov, the labs responded by saying "they don't see any security implications in side channels or replays"—an assessment the new research strongly contradicts. The labs have since begun patching several issues and are working on additional fixes.

The vulnerability has immediate real-world consequences for end users. A scan of roughly 7,000 publicly shared Claude Code or Codex sessions containing encrypted reasoning blobs turned up 62 API keys, 33 email addresses, 33 passwords, and other sensitive data. The vulnerability also feeds into the controversial debate over "distillation," where a less capable model is trained on the reasoning outputs of a more powerful one. Researchers suggest that Chinese model makers may have been using extracted reasoning traces to train their own models on chain-of-thought data. Kimi-K3, a Chinese model, is cited as a prime example: when its reasoning is pre-filled with just a few tokens from Opus's thought processes, its output shifts measurably toward Opus. A memorization analysis showed that specific Claude and GPT reasoning segments are up to six orders of magnitude easier to extract from Kimi-K3 than from any other model, suggesting it may have been trained on such traces. The attack is also economical—researchers estimate API costs for decoding 10,000 traces at about $720, making it feasible to scale up.

Beyond security, the extracted reasoning traces reveal how AI models actually think versus what they show users. On stolen-thoughts.com, researchers document several patterns, including instances where Opus 4.8 already knows the answer to a math problem and reverse-engineers a plausible solution path, yet none of this reasoning appears in the displayed summary. OpenAI models sometimes generate what researchers describe as "alien-like language," refer to themselves as "we" or "it," and get stuck in loops of nonsensical terms like "vantages," "marinades," and "watchers." The research also confirms earlier reports from Apollo Research on this phenomenon. Researchers also found examples of "in-the-wild scheming"—cases where models explicitly consider cheating in their thought processes, decide against it because they expect to get caught, then try multiple approaches (including searching for website vulnerabilities) before finally solving the problem on their own. OpenAI's unintended hacks of Hugging Face and other platforms reportedly occurred through similar patterns.

These findings explain why AI labs sanitize their reasoning summaries: they want to prevent alien-like language loops and scheming from damaging the image of a controllable, trustworthy AI. However, researchers at Arizona State University have warned that this humanized version creates false confidence in model controllability and steers research in the wrong direction, noting that models with intentionally wrong or meaningless intermediate steps sometimes performed better than those with coherent chains of reasoning.