**Major AI Reasoning Models Found Vulnerable: Encryption Key Flaw Exposes Sensitive Data**
Security researchers have uncovered a critical vulnerability affecting the leading AI reasoning models from Anthropic, OpenAI, and Google. The flaw allows attackers to decode encrypted “inner thoughts”—the step-by-step reasoning processes these models use before delivering a final answer—and extract sensitive information hidden within them.
The research, conducted by a team from MATS Research, the ELLIS Institute Tübingen, the Max Planck Institute for Intelligent Systems, and security firm Snyk, revealed that all three providers use a single, global encryption key for securing reasoning blocks across their entire ecosystems. This architectural shortcut means that encrypted reasoning from one model can be injected into a less protected sibling model and decoded without resistance.
By scraping 6,708 publicly shared AI agent transcripts from GitHub and Hugging Face, the researchers decoded 315,320 reasoning blocks and recovered 182 credentials. These included 62 live API keys, 33 passwords, and 30 personal email addresses. In total, 366 pieces of Personally Identifiable Information (PII) were extracted from encrypted logs that developers had mistakenly believed were safe simply because they were invisible in plaintext.
—
### How the Attack Works
The vulnerability exploits the fact that encrypted reasoning blocks are not tied to a specific user, session, or model. Because these blocks are fully interchangeable across contexts, an attacker can force a less-secured model—such as Claude Haiku 4.5—to decode and output confidential reasoning data belonging to a more powerful model like Claude Opus 4.8.
This “cross-model portability” attack does not require special access or exploit unknown vulnerabilities. Standard API access, which developers use to build AI-powered applications, is sufficient to carry out the attack. The researchers demonstrated the technique across multiple providers, including OpenAI’s GPT-5.6 family and Google’s Gemini lineup.
One of the most concerning findings is that proprietary reasoning patterns could be extracted and potentially used for model distillation—where a smaller model is trained to mimic the behavior of a larger one. The attack also enables invisible prompt injection, where malicious instructions are hidden within encrypted reasoning and evade traditional security monitoring tools.
—
### Real-World Risks and Impact
The fact that public logs already contain sensitive data is only part of the problem. Although the providers have deployed server-side patches to prevent new data from being exposed, the historical logs that have already been shared online remain vulnerable. These logs often sit in public repositories, with developers unaware of the credentials, passwords, and private details hidden inside encrypted reasoning traces.
According to the paper, the exposure stems from a widespread misunderstanding of how encrypted reasoning data is protected. Many developers assume that encryption alone is sufficient to safeguard intermediate computations, but the use of a single global key across the entire platform creates a systemic weakness.
The researchers responsibly disclosed their findings, prompting Anthropic, OpenAI, and Google to issue emergency fixes. However, the damage is already done—once sensitive reasoning data is exposed in public logs, it cannot be fully retracted.
—
### FAQ
**Q: What are AI reasoning models?**
A: AI reasoning models are designed to pause before answering and work through a step-by-step “chain of thought” process. This internal reasoning helps them solve complex problems but is normally hidden from users.
**Q: Why is encryption important for reasoning blocks?**
A: Encryption protects proprietary algorithms and sensitive intermediate steps from being viewed by users or competitors. It is meant to safeguard intellectual property and ensure safety compliance.
**Q: How were researchers able to decode encrypted reasoning blocks?**
A: Because all models from a single provider share one encryption key, reasoning blocks can be moved between models—especially weaker ones—and decoded without triggering security measures.
**Q: What kind of data was exposed?**
A: Researchers recovered API keys, passwords, personal email addresses, and other sensitive information embedded within encrypted reasoning traces that were never meant to be seen.
**Q: Are the security patches enough?**
A: While new data is now better protected, historical logs that have already been shared publicly remain vulnerable and continue to pose a risk.
**Q: Can end users do anything to protect themselves?**
A: Users should avoid sharing session logs or reasoning data in public repositories and remain aware that encrypted outputs may still contain sensitive information if systemic vulnerabilities exist.
—
### Conclusion
This research highlights a fundamental design flaw in how major AI providers handle encrypted reasoning data. While encryption is a critical security layer, relying on a single global key across entire platforms creates dangerous interoperability risks. The ability to move reasoning blocks between models and decode them without detection exposes not only credentials and personal data but also the inner workings of proprietary AI systems.
Although patches have been deployed, the exposure of thousands of historical logs demonstrates the lasting impact of architectural decisions made in pursuit of scalability and convenience. As AI reasoning becomes more advanced and widely used, ensuring that each interaction remains securely isolated will be essential—not just for protecting data, but for maintaining trust in AI systems as a whole.
