Replay flaw let weaker models decode Claude, GPT & Gemini traces
182 credentials and 367 PII artifacts came out of public agent logs by replaying encrypted reasoning — scrubbing the visible chat leaves the secrets in.
Copy markdown
Weaker models are 'fuzzy decoders' for stronger ones
The attack replays a provider's encrypted reasoning blocks across sessions, users and models — a cheaper sibling like Claude Haiku 4.5 will transcribe reasoning produced by stronger models in the same family. From public repositories the team decoded 315,320 hidden thinking blocks.
The secrets hid in the thinking, not the chat
Across real public agent logs researchers recovered 182 credentials and 367 pieces of PII — including 62 API keys, 33 passwords and 24 access tokens — and 64 of those artifacts appeared only inside hidden reasoning, invisible to any scrub of the visible transcript.
What to do before you publish a trace
The core extraction is no longer reproducible as of August 2026, but no vendor has publicly owned it. Anthropic's docs now tell you to strip thinking blocks when you switch models; OpenAI still recommends replaying reasoning for stateless history; Google says its backend handles compatibility. Don't ship raw agent logs with reasoning objects intact.
Elsewhere: Nvidia's Nemotron 3.5 Lightning runs on one GPU
A 30B open MoE with 3B active params and a 1M-token context, hitting ~1,200 tokens/sec on a single H100 or DGX Spark — and locally via Ollama and llama.cpp. Weights, data and recipes ship under the permissive OpenMDW license with a free OpenRouter tier; it posts 52.8 on SWE-bench Verified and ships with NeMo Switchyard, an open router that sends each agent step to the cheapest capable model.