Security researchers have uncovered a sweeping vulnerability affecting nearly every major artificial intelligence provider, revealing that the hidden "reasoning" content generated by chatbots can be decoded and read by outsiders. The flaw allowed the team to unlock more than 315,000 supposedly private thinking blocks from publicly accessible logs, exposing sensitive data including passwords and active API keys.
How the Exploit Works
At the heart of the problem is how AI companies handle so-called reasoning tokens—the intermediate steps a model works through before delivering a final answer to a user. These tokens are meant to remain confidential, hidden from view even as the visible output is displayed. But researchers discovered that providers were encrypting this content using a single global key shared across their systems.
Because the same key protected every user's reasoning data, cracking it once opened the door to decoding vast quantities of hidden material. The team applied this method to logs that were already publicly available, transforming scrambled text into readable transcripts of what the models were internally "thinking."
A single shared key turned millions of private machine thoughts into an open book.
The scale of the recovery was significant. Researchers reported decoding 315,320 hidden thinking blocks, a figure that illustrates just how widespread the exposure became once the encryption was bypassed.
What Was Exposed
The decoded material proved to be far more than harmless internal chatter. Buried within the reasoning traces were genuine credentials, including passwords and live API keys that could grant access to real accounts and services. That elevates the finding from an academic curiosity to a practical security concern for anyone whose data passed through affected systems.
The incident raises pointed questions about how AI firms safeguard the intermediate outputs their models produce. Reasoning content is often assumed to be ephemeral or private, yet this research demonstrates that weak key management can undermine those assumptions entirely.
- Every major AI provider was found using a single global encryption key
- More than 315,000 hidden reasoning blocks were decoded
- Recovered data included passwords and active API keys
- The source logs were already publicly accessible
For the AI industry, the findings serve as a warning that securing visible outputs is not enough. As models increasingly rely on extended internal reasoning, the protection of those hidden steps may become just as critical as guarding the answers users actually see.