RESEARCHERS CRACKED AI'S 'ENCRYPTED' THINKING — AND PULLED OUT PASSWORDS AND API KEYS

Researchers extracted hidden reasoning traces from Anthropic, OpenAI and Google APIs by replaying encrypted blocks through weaker models in the same provider families — Claude Haiku 4.5, GPT-5.6 Luna and Gemini Robotics 1.6 decoded traces from stronger models. They decoded 315,320 reasoning blocks scraped from public repositories and recovered 367 personally identifiable information artifacts and 182 credentials, including 62 API keys, 33 passwords and 30 personal email addresses.

The researchers outline four attack paths: stealing proprietary reasoning to distill rival models, recovering credentials from publicly shared logs, hidden prompt injection through poisoned reasoning blocks, and jailbreaking through the hidden reasoning channel. As of July 2026, no provider had published a detailed description of the cryptographic mechanism behind the reasoning blocks.