AI's 'Inner Thoughts' Exposed: The Reasoning-Token Exploit Explained

In August 2026, researchers revealed a flaw affecting the hidden reasoning of AI models from OpenAI, Google, and Anthropic: because the companies used a single global encryption key for reasoning tokens, a weaker "sibling" model could be tricked into decoding the inner thoughts of a flagship model [1][2][3]. Scraping public logs, the team recovered 182 credentials, including 62 live API keys and 33 passwords [1][3]. All three providers have since patched their APIs [1][2].

Story at a glance

What: hidden reasoning, exposed

Frontier AI models "think" in a hidden scratchpad of reasoning tokens before answering. To keep APIs stateless, providers encrypt these tokens and send them to the client, which passes them back with each request [1][3]. Because the encryption key was global within each provider, an encrypted block from a powerful model worked in a weaker sibling model too [1][2][3].

Why it matters: secrets in the thinking

The researchers found that sensitive data — passwords, API keys, personal emails — often appears only in the hidden reasoning, never in the final visible output [1]. Anyone who shared an agent transcript publicly could have leaked secrets without knowing it [1].

Who: the researchers and the providers

The work came from MATS Research, the ELLIS Institute Tübingen, the Max Planck Institute, and Snyk [1]. The affected providers are OpenAI, Google, and Anthropic [1][2][3].

When: disclosure and patches

Where: public AI agent logs

The researchers scraped 6,708 public AI agent transcripts from GitHub and Hugging Face, decoding over 315,000 reasoning blocks [1].

Which: the numbers that matter

What leaked

Four attack vectors

• Model distillation: Steal proprietary reasoning to train cheaper models [1].
• Private data extraction: Mine public logs for secrets [1].
• Hazardous info leakage: Extract content the model refused to output [1].
• Invisible prompt injection: Hide malicious instructions inside encrypted blocks [1][3].

How: the decryption oracle

The attack is a cross-model decryption: capture an encrypted reasoning block from a flagship model, inject it into a request to a weaker sibling model, and the weaker model — lacking the flagship's guardrails — decodes and outputs the inner thoughts in plaintext [1][2][3]. The researchers called it a "scalable decryption jailbreak" [3].

What next: patches and lessons

The historical parallel

This follows a pattern of AI safety incidents that forced API-level fixes — from early jailbreaks that bypassed content filters to prompt-injection attacks on agentic systems [1]. Each time, the industry patched the specific hole; the reasoning-token flaw is the first to break the encryption itself [1][3].

The future outlook

• Patches are live: All three providers deployed server-side fixes; the primary attack is no longer reproducible as of August 2026 [1][2].
• Old logs stay exposed: Transcripts shared before the patch remain decodable with the compromised keys [1].
• Better designs: Researchers suggest keeping reasoning traces server-side or using cryptographic contextual binding to tie blocks to specific sessions [3].

What to watch: whether providers move reasoning fully server-side, and whether developers scrub old public logs for leaked secrets [1][3].

References

1. Decrypt — 'Inner Thoughts' of every major AI model exposed in massive exploit
2. The Hacker News — OpenAI, Anthropic, Google API flaw let weaker AI models decode stronger models' reasoning
3. arXiv — Stealing reasoning traces from proprietary LLM APIs
4. heise online — Encrypted AI 'reasoning process' hacked: weaker models reveal secrets

Disclaimer

This content is for educational purposes only. Figures are as of 14 August 2026 and may be revised. Always verify current information before relying on it.