Researchers Crack the Encrypted Thoughts of ChatGPT, Claude, and Gemini

Before answering, reasoning models like GPT-5.6, Claude Opus 4.8, or Gemini first “think,” and providers encrypt that internal process so nobody can read along. A research team led by Alexander Panfilov has now broken that protection, according to a paper published on August 11, 2026. The researchers didn’t just read along, they also found dozens of passwords and API keys hidden inside real, publicly available session logs, credentials that existed only in these supposedly sealed reasoning traces.

Key takeaways

• Researchers led by Alexander Panfilov extracted encrypted reasoning traces from the APIs of OpenAI, Anthropic, and Google.
• The reason: every model in a given product family shares the same global encryption key instead of one bound to a user or session.
• Scanning roughly 6,700 public agent transcripts turned up 62 API keys, 33 passwords, and other private data.
• Some of this sensitive data existed only in the internal reasoning trace, never in the model’s visible answer.
• OpenAI, Anthropic, and Google confirmed the findings and have since deployed server-side mitigations.

How the attack works

Reasoning models such as OpenAI’s o-series, Claude Opus, or Gemini generate so-called reasoning tokens as they work through a problem before producing a final answer. For competitive reasons, providers usually don’t show users this raw text directly, offering only an encrypted, base64-encoded summary or nothing at all. Panfilov’s team discovered that this encryption isn’t tied to an individual account, session, or specific model, it uses the same key across an entire provider’s model family. That makes it possible to inject an encrypted reasoning block from a powerful model like Claude Opus 4.8 into a weaker, jailbroken sibling model such as Claude Haiku 4.5, which then decodes and transcribes the borrowed reasoning verbatim. As kabel-salat.info reported on a recent weakness found in a NIST cryptography candidate, the lesson keeps repeating itself: encryption is only as strong as its key management, and a globally shared key is architecturally the opposite of secure.

What was hiding in the reasoning traces

To demonstrate the scale of the problem, the researchers analyzed roughly 6,700 publicly available agent transcripts from research datasets and reconstructed more than 300,000 individual reasoning blocks from them. The result: 62 live API keys, 33 passwords, and dozens of other credentials and personal details such as email addresses. Particularly striking is that some of this data appeared exclusively inside the internal reasoning process, never intended for human eyes, and not in the model’s visible reply. Users who assumed their AI assistants had discarded or never logged sensitive input were wrong. Decoding 10,000 such traces cost the researchers only about $720, a trivial expense for a targeted attack.

More than a privacy problem

Beyond the risk to individual users, the researchers point to a second consequence that hits providers themselves: anyone who can fully read a flagship model’s raw reasoning could in theory use it to train their own, cheaper model on top of it, a so-called distillation attack. That is exactly what OpenAI, Anthropic, and Google tried to prevent by encrypting and summarizing reasoning in the first place, since the ability to work through a problem in traceable steps is one of the most expensive and closely guarded properties a model has. The researchers also noted that some of the recovered reasoning was, at times, disjointed or hard to follow, a sign that the internal thought process doesn’t always match the smooth, coherent argument users assume is happening when they only see a polished summary of it.

How providers responded

Following responsible disclosure, OpenAI, Anthropic, and Google confirmed the findings and rolled out server-side mitigations; according to the researchers, the demonstrated attacks could no longer be reproduced afterward. Panfilov noted that providers initially saw no security implications at all, a pattern familiar from earlier disclosures of AI security flaws. Just days earlier, Anthropic had announced it would begin watermarking generated text and images, as kabel-salat.info reported. The case points to a broader problem: as AI systems are deployed as autonomous agents with access to credentials, terminals, and other services, more sensitive information ends up in internal processing steps that users never see and whose security they can’t independently verify.

The takeaway

The study shows that “invisible” doesn’t mean “secure.” Providers encrypted internal reasoning primarily to stop competitors from reverse-engineering their model architecture, not chiefly to protect user data, and that exact gap in the threat model became the way in. For companies equipping AI agents with real credentials, it’s a wake-up call: anyone typing a password or key into a chat or agent prompt should assume that information gets processed and cached somewhere, and in the worst case can be read back out, no matter how polished the visible interface looks. Until providers bind encryption to individual sessions, the safest rule remains the one that predates the study: credentials don’t belong in a chat prompt, no matter how trustworthy the interface looks.