Researchers from MATS Research, ELLIS Institute Tübingen, the Max Planck Institute for Intelligent Systems, and the security company Snyk submitted on Monday (10) a study that reveals a flaw capable of reading the encrypted internal reasoning of artificial intelligence models from Anthropic, OpenAI, and Google.
The study states that reasoning models use an internal record of steps before responding and that companies encrypt these blocks to protect their intellectual property. The flaw lies in the use of a single encryption key per provider: according to the researchers, the blocks are "fully compatible and interchangeable" across sessions, users, and even different models from the same company.
In the attack, the researchers injected an encrypted block from Anthropic's Claude Opus 4.8 model into a weaker and less protected model, Claude Haiku 4.5, which lacks the safety training against distillation present in Opus. Haiku decoded and reproduced the reasoning in plain text. The same technique worked on OpenAI's GPT-5.6 family and Google's Gemini line, with standard API access.
In a demonstration of real-world impact, the team analyzed 6,708 transcripts of AI agent sessions shared publicly on platforms such as GitHub and Hugging Face. The researchers decoded 315,320 reasoning blocks and recovered 367 personal data artifacts and 182 credentials, including 62 active API keys and 33 passwords. Most of this information did not appear in the visible output of the models.
Attack vectors
In addition to credential theft, the study lists four attack vectors: extraction of proprietary reasoning patterns to train competing models via distillation; extraction of private data from shared logs; injection of invisible prompts inside encrypted blocks, without detection by monitoring tools; and circumvention of the security of powerful models through less protected versions.
After responsible disclosure, Anthropic, OpenAI, and Google applied mitigations on their servers. The fixes are already in effect, but the 6,708 transcripts with decoded blocks that were already on the internet remain available.
