AI thoughts can be read using another AI, revealing passwords and keys inside

Eight researchers from ELLIS Institute Tübingen, the Max Planck Institute for Intelligent Systems, Tübingen AI Center, MATS, and Snyk published a preprint on August 10 describing an attack on the encrypted reasoning traces of models from Anthropic, OpenAI, and Google. The attack works by taking the encrypted block from a strong model (e.g., Claude Opus 4.8) and feeding it to a weaker model from the same provider (e.g., Haiku 4.5), which is then asked to rewrite the reasoning verbatim, thus decrypting it. The attack does not crack the encryption or attack the strong model; it exploits the fact that the encrypted block is returned to the client and must be re-sent with the next request. The researchers verified the authenticity of the decrypted traces on 120 Codeforces tasks. They also scanned 6708 public agent logs from GitHub and Hugging Face, recovering 315,320 reasoning blocks, which contained 704 unique secrets, including 62 API keys, 33 passwords, 24 access tokens, plus emails, names, and internal URLs. Notably, 64 of these secrets were not visible anywhere in the visible session, existing only inside the encrypted blocks. The paper also describes a poisoning vector where a malicious block can be planted to inject instructions into an agent that later loads it. The authors propose cryptographic and system measures to bind the block to the session, user, and model, but for now, users should treat encrypted reasoning blocks as secrets and avoid sharing logs publicly.