Security researchers found a vulnerability in the APIs of every major AI provider that lets them read the encrypted thought processes of reasoning models. A scan of publicly shared sessions turned up dozens of passwords and API keys.
When AI models like OpenAI's o-series, Anthropic's Claude, or Google's Gemini "think" through complex tasks, they generate internal reasoning tokens. These thought processes are either shown to users as a summary or kept completely hidden. Providers encrypt the raw reasoning steps, partly to protect their intellectual property.
A research team led by Alexander Panfilov has now found a way to extract these encrypted reasoning processes through a vulnerability in the APIs of all leading AI providers. For most queries, the number of extracted tokens matches the billed thinking tokens exactly, meaning the researchers are capturing the full internal reasoning, not just partial snippets.
Encrypted thoughts travel freely between models
The researchers say the encrypted thought processes are "fully portable across sessions, users, and models within a single provider." Anthropic's smaller model, Haiku 4.5, can read the thoughts of the far more capable Opus 4.8. Through jailbreaking, Haiku can be tricked into transcribing Opus's raw thought processes word for word without attacking the more robust Opus directly. The same trick works with OpenAI and Gemini.
