Not a product — a security paper, posted August 10, 2026, and already at 97 points on Hacker News. Eight authors including Ilia Shumailov and Jonas Geiping show that the encrypted reasoning blocks Anthropic, OpenAI, and Google hand back to API clients are interchangeable across sessions, users, and models from the same vendor.
The attack is embarrassingly simple
Take the ciphertext a frontier model produced. Feed it to a weaker sibling model with looser guardrails. Ask it to read the block back. Out comes the stronger model’s hidden chain of thought in plaintext.
The team scraped 6,708 public agent trajectories off GitHub and Hugging Face, decoded 315,320 reasoning blocks, and pulled out 367 PII artifacts and 182 credentials — API keys, passwords, access tokens, real email addresses. Developers pasted those logs publicly because the blocks looked like opaque garbage.
Where the hole sits in the API
It’s the encrypted_content / reasoning block field on every provider’s public API — anyone calling it can reproduce this. Two nastier consequences: a request the model refuses out loud can still leave hazardous content in the hidden trace, and an attacker can bury a payload inside an encrypted block for invisible prompt injection into public agentic rollouts.
Hiding chain of thought was the industry’s default answer to distillation and IP leakage. This is the first proof that the default is broken at the architecture level, not the implementation level.
You Might Also Like
- Anthropic to Acquire Stainless for 300m Buying the Developer Pipe to Openai and Google
- Google Gemini Enterprise Gives Every ai Agent a Cryptographic id its Real Fight With Openai and Anthropic
- Roguepilot Github Copilot 漏洞 the Prompt Injection That Turned Your ai Assistant Against you
- 13b Into Openai yet Microsoft Copilot Cowork Runs on Anthropic Claude
- Cursor Composer 2 Takes on Anthropic and Openai With a 0 50 m Token Coding Model and the Benchmarks Back it up
Top AI Product 
Leave a comment