Your AI's hidden reasoning leaked keys and passwords

Researchers just read the hidden reasoning of GPT, Claude and Gemini models, and found live credentials inside. The paper, Stealing Reasoning Traces from Proprietary LLM APIs, went up on arXiv on August 10. OpenAI, Anthropic and Google all return encrypted “thinking blocks” through their APIs, so agents can carry reasoning between calls. The team showed those blocks stayed valid across sessions, users and models in the same family.

Nobody cracked the encryption. The researchers replayed a strong model’s encrypted block into the weakest sibling model that would accept it, Claude Haiku 4.5 in the Claude case, and asked it to transcribe the attached reasoning word for word. It did. Simon Willison has published examples of what the recovered traces look like.

Then the team went looking for what this exposes in practice. They collected 6,708 public agent trajectories from GitHub and Hugging Face, raw transcripts developers had committed next to their code, and decoded 315,320 reasoning blocks from them. Genuine user sessions gave up 704 sensitive artifacts, among them 62 API keys, 33 passwords, 24 access tokens and 7 private keys. The number I would show a board is 64. That is how many of the 704 appear nowhere in the visible chat history. The model saw a secret during the session and carried it in reasoning nobody was supposed to read.

The vendors mitigated after responsible disclosure in May, and the paper states the extraction attack stopped reproducing in August 2026. The exposure that remains sits in your repositories, not in their APIs. Every raw transcript pushed to a public repository before the fix still holds intact reasoning blocks, and those blocks passed every secret scanner and code review as opaque ciphertext. Nobody rotates a credential they cannot see.

Three moves this week. Treat agent transcripts and traces as secrets, not as logs, and keep them out of public repositories. Search the repositories you already publish for committed API transcripts, and rotate every credential that passed through those agent sessions. And strip reasoning blocks from any trace you share externally, the same way you scrub .env files before a push.

Ghostjacking showed last week that data an agent reads can become commands it runs. This paper adds the mirror image: what an agent reads can resurface in reasoning you never see. We treat both as core AI security work, and our report on AI-driven hacking covers why findings like this now land weekly rather than yearly.

Talk to me if you want a read on what your agents may have left in public logs.

Drafted with AI assistance, reviewed and edited by Fredrik Standahl and the FM CyberSecurity editorial team.

Sources

• Panfilov et al., “Stealing Reasoning Traces from Proprietary LLM APIs,” arXiv:2608.09867, August 10, 2026
• Simon Willison, “Stealing Reasoning Traces from Proprietary LLM APIs,” simonwillison.net, August 11, 2026
• The Hacker News, “OpenAI, Anthropic, Google API Flaw Let Weaker AI Models Decode Stronger Models’ Reasoning,” August 12, 2026