Encrypted reasoning traces cracked across Claude, GPT, and Gemini
One shared key per model family let weak siblings decode 315K thinking blocks; 62 API keys leaked from public logs. Patched, but stop committing raw traces.
Copy markdown
Weaker siblings decoded their bigger siblings' thoughts
Each model family shared a single encryption key, so an encrypted chain-of-thought block from a frontier model could be replayed into a cheap sibling — Claude Haiku 4.5, GPT-5.6 Luna, Gemini Robotics ER-1.6 — and jailbroken into plaintext. The “encryption” was never a security boundary.
315,320 thinking blocks, with real secrets inside
Sweeping 6,708 public agent trajectories, researchers decoded 315,320 hidden reasoning blocks and pulled 704 live secrets from them — 62 API keys, 33 passwords, 24 access tokens, 7 private keys — all sitting in fields users assumed were opaque.
Treat encrypted reasoning as readable, not secret
Strip reasoning blocks and opaque reasoning fields before sharing a trace, and never commit raw API transcripts to a repo — a sanitized visible answer can still carry a decodable block. Anthropic now binds thinking blocks to their origin model and Google handles compatibility server-side, but OpenAI still tells you to replay encrypted blocks.
Elsewhere: OpenAI ships a zero-day-hunting model
OpenAI opened its Daybreak Red tier with GPT-5.6-Cyber, a security model it says already found two Chrome V8 zero-days (including CVE-2026-15903). Access needs identity verification and approved-use attestations, and every Daybreak account must move to hardware security keys by Sept 1.