Researchers Decoded 315,000 AI 'Thoughts.' API Keys and Passwords Fell Out.

Eight researchers just published a paper showing that the encrypted "chain of reasoning" that Anthropic, OpenAI, and Google send back through their APIs can be read. Not cracked like a movie hacker. Fed into a cheaper, weaker sibling model, which then prints out the flagship model's hidden thoughts word for word. Two API calls. That's the whole attack.

They scanned 6,708 publicly shared agent sessions on GitHub and Hugging Face and decoded 315,320 reasoning blocks. Inside them they found 62 API keys, 33 passwords, 24 access tokens, and 30 personal email addresses. Plus names, home addresses, and internal company links.

I'll be honest, this story doesn't really surprise me. But that's not a compliment to anyone involved.

How it happened

Here's the part that actually got me. None of the labs built a bad lock. They built a lock that works everywhere. The encrypted reasoning blocks from any model in a company's family work with any other model, any user, any session. That was done on purpose so conversations could flow between models without the company storing anything. So a researcher grabs an encrypted block from Claude Opus 4.8, hands it to Claude Haiku 4.5, and Haiku, being cheaper and less guarded, just reads it out loud. Same trick works on OpenAI and Google.

That's the AI companies getting lazy with encryption. Not lazy like they forgot to turn it on. Lazy like they shipped it and moved on. There was already a warning, by the way. In May, a cryptography expert named Matthew Green reported that these blocks could be replayed. According to the researchers, the labs' response was that they didn't see any security implications. Three months later, this paper exists.

Check what you've shared

Here's the part that should make you pause. The keys didn't come out of some foreign adversary breaking in. They came out of sessions that people posted publicly to GitHub or Hugging Face, without ever looking inside the encrypted block, because it looks like scrambled garbage. The leak channel is every developer who shares an agent log without scrubbing it.

So this is one more reason to be a lot more careful about what we make public. If you've ever shared a Claude Code or Codex session, check what's in there. The visible part isn't the whole story.

The AI was cheating on the math

Here's the part I actually found funny. In the decoded thoughts, Opus 4.8 sometimes looks at a math problem, realizes it already knows the answer from training, and then writes out a clean step-by-step solution like it worked the whole thing out itself. The summary you see looks like an honest derivation. The hidden trace shows it knew the answer up front and performed the homework for show.

That's AI using AI to cheat, basically. The model is cheating on its own homework and then handing in a clean write-up. I don't know why I find that so funny. A machine performing the work it didn't do, for an audience of humans, feels like the most human thing these models do all day.

What the labs need to fix

Here's what I didn't realize before reading this. The chain of reasoning the interface shows you is not the actual chain of reasoning. It's a cleaned-up summary. The real one gets encrypted and sent along so the conversation can continue. I had no idea the two were different things.

That's why this matters beyond the leaked keys. If the labs want to keep hiding their reasoning, they're going to need a whole new architecture to do it. Bind every block to the specific session and user so it can't be replayed somewhere else. Or stop handing the reasoning to the client at all and store it on their side. They should have thought about that from the start. Instead they shipped a shortcut, a cryptography expert flagged it in May, and a research team proved it wide open in August.

To be fair, the labs patched several issues after the researchers disclosed them responsibly, and the attack doesn't work anymore. But here's the catch: the sessions already scraped from the public web are gone. Those 6,708 logs and the keys inside them are not coming back.

So the lesson lands on us too. The labs need better locks. And we need to stop handing the keys to anyone who walks by.