Every Major AI Lab's Reasoning Was Exposed by a Single Bad Key
Researchers at the ELLIS Institute and Max Planck Institute decoded 315,320 hidden reasoning blocks from Anthropic, OpenAI, and Google APIs using a single global encryption key flaw, and pulled 182 live credentials from public logs in the process.
Anthropic, OpenAI, and Google all encrypted their AI reasoning tokens with one shared global key, and researchers just proved that was a catastrophic design choice.
Key takeaways
- Researchers at the ELLIS Institute Tübingen and Max Planck Institute decoded 315,320 hidden AI reasoning blocks scraped from 6,708 public agent trajectory logs, recovering 182 credentials including API keys, passwords, and access tokens from real user sessions.
- All three providers used a single global encryption key for reasoning tokens, enabling cross-session and cross-model decryption; a weaker model from the same provider could be used as a decoder ring for a stronger model's hidden reasoning without ever directly breaking the stronger model.
- Johns Hopkins cryptographer Matthew Green flagged the underlying replay vulnerability to the labs in May 2026 and was told they saw "no security implications." The full working exploit materialized anyway.
Researchers at the ELLIS Institute Tübingen and Max Planck Institute for Intelligent Systems published a paper on August 10, 2026 demonstrating that Anthropic, OpenAI, and Google all rely on a single global encryption key to protect AI reasoning tokens, and that a researcher with a standard API key and knowledge of the flaw can decode those tokens at scale. The paper, "Stealing Reasoning Traces from Proprietary LLM APIs", scraped 6,708 publicly available agent trajectory logs from GitHub and Hugging Face, decoded 315,320 reasoning blocks, and recovered 182 credentials from genuine user sessions.
The labs were warned. They did nothing.
The Architecture Flaw
The attack exploits a property the paper confirms in its abstract: all three providers authenticate and encrypt every reasoning block with one key shared globally across sessions, users, and models within a provider. Because the blocks are interchangeable, lead researcher Alexander Panfilov and co-authors developed what they call a "decryption jailbreak." Inject an encrypted reasoning trace from a powerful model, say, Claude Opus 4.8, into a weaker, less-guarded model like Claude Haiku 4.5, and the weaker model transcribes the raw reasoning verbatim in plaintext. No need to jailbreak the stronger model directly. The same method worked against OpenAI and Google Gemini.
"We found a way to extract hidden reasoning of frontier models using a vulnerability in the APIs of every frontier AI company," Panfilov posted on X on August 11, 2026.
The precursor disclosure is what makes the labs' posture indefensible. Johns Hopkins Associate Professor Matthew Green published the initial replay vulnerability finding on May 29, 2026. The labs were notified. Per Panfilov's follow-up X thread, they responded that they saw "no security implications" in side channels or replays. The Panfilov team then built a fully working attack directly on top of Green's finding. Green later updated his post noting the team had "turned it into a real working attack."
What Was Actually Exposed
The credential recovery from real sessions included API keys, passwords, and access tokens. The 315,320 decoded reasoning blocks came from public repositories and published agent trajectory logs, material that users and developers had already made public, encrypted or not, assuming the encryption meant something. Per the authors, the main extraction attack is no longer reproducible as of August 2026 following mitigations from the providers. No confirmed malicious exploitation in the wild was documented in the paper.
The "no longer reproducible" framing deserves scrutiny. A server-side patch stops future extraction. It does not touch a single reasoning block already sitting in a public GitHub repo or an agent log published before August 2026. Those blobs remain decodable by anyone who ran the attack during the testing window in early July 2026. Past exposure is not retroactively erased.
If your team ran agentic AI workflows against these APIs, committed session transcripts to a repo, or published agent traces anywhere public, treat those credentials as compromised. Rotate API keys, passwords, and access tokens that touched these systems.
What the Design Choice Actually Reveals
The single global key architecture was not an oversight. It was a cost-efficiency decision: globally interchangeable reasoning blocks are cheaper to manage and route than per-session isolated keys. The labs pitched encrypted reasoning as IP protection and a mechanism to "limit information leakage" to API clients. The actual threat model protected the provider's proprietary chain-of-thought from competitors, not users' secrets from the provider's own attack surface.
This is the predictable consequence of building AI infrastructure on a trust-the-provider model. The open-source AI case just got a hard data point. A locally-run model has no encrypted reasoning blocks transmitted to a centralized server, no global key managed by a third party, and no API session logs that could end up in a public repository. The attack surface this paper describes is structurally specific to hosted, proprietary API architectures.
The paper also raises a question it does not answer with peer-reviewed evidence: whether prefilling a third-party model's reasoning with stolen frontier reasoning tokens measurably shifts its outputs, pointing toward possible distillation of US labs' hidden chain-of-thought by external parties. The researchers flagged this as a preliminary observation, not a confirmed result. It warrants scrutiny.
The falsifiable thesis here is clean: centralizing AI reasoning under a single provider-controlled global key guarantees eventual mass credential exposure. It collapses into a "they patched it" story only if all three labs ship per-session, per-user cryptographic key isolation and a credible independent audit confirms the fix holds. That audit does not yet exist.
What to Watch
The labs have issued mitigations, but none have publicly committed to per-session key architecture or third-party audits of the fix. Watch whether Anthropic, OpenAI, and Google disclose the scope of exposure to affected enterprise customers, and whether any evidence of pre-patch exploitation surfaces in incident reports. The surveillance and privacy implications of centralized AI infrastructure keep compounding, this paper adds a concrete credential-loss vector to a threat model that most enterprise AI buyers have not priced in.
Sources
Frequently Asked Questions
The patch prevents future extraction. It does not retroactively secure reasoning blocks already committed to public repositories, shared agent logs, or published traces. Anyone who ran the attack during early July 2026 could have decoded those blobs before mitigations landed. Past exposure stands regardless of the server-side fix.
No external infrastructure was needed. Researchers used a weaker model from the same provider as a decoder ring for a stronger model's hidden reasoning, exploiting the providers' own API design. The attack required only a standard API key and knowledge of the global-key architecture. That is not a breach of a database; it is a consequence of the encryption scheme itself.
Structurally, yes. A locally-run model generates no encrypted reasoning blocks transmitted to a centralized server, involves no global key managed by a third party, and produces no API session logs that could end up in a public repository. The vulnerability described in this paper is specific to hosted, proprietary API architectures where a single provider controls both the encryption and the models.
