A critical security flaw has exposed how encrypted reasoning traces sent by leading AI companies can be stolen using cheaper, less-guarded versions of the same models. Researchers found that the encrypted "thinking" blobs that Claude, GPT, and Gemini return to users are fully portable and can be decoded without breaking encryption at all.

The attack is straightforward: take an encrypted reasoning blob from Claude Opus, inject it into the cheaper Claude Haiku model, and Haiku will simply read it aloud. No cryptographic breaking required. The same technique works on OpenAI and Google Gemini models. This means proprietary reasoning patterns, step-by-step logic, and internal decision-making processes that companies intended to keep private can be extracted using a model that costs a fraction of the price.

What Sensitive Information Is Actually at Risk?

The real-world impact is concrete and alarming. Researchers scanned approximately 7,000 public session logs and discovered 62 API keys, 33 email addresses, and 33 passwords hidden inside encrypted blobs that users believed were secure. These credentials were decodable by anyone with access to a cheaper model variant.

The vulnerability exposes more than just credentials. It also surfaces information that models deliberately refused to include in their visible responses but reasoned through internally. This means hazardous or sensitive information that a model was trained to reject can still be extracted from its hidden reasoning layer. Additionally, attackers can inject invisible malicious instructions inside encrypted blobs to poison shared agent workflows, creating a supply-chain risk for teams using AI agents across multiple systems.

How to Reduce Your Exposure to This Vulnerability

• Audit Public Sessions: If you have shared Claude Code or Codex sessions publicly, those encrypted blobs are now decodable. Review your session history and consider regenerating any API keys or credentials that may have been exposed in those sessions.
• Rotate Credentials Immediately: Treat any API keys, passwords, or sensitive data that may have been used in AI sessions as potentially compromised and rotate them proactively to limit exposure window.
• Verify Patch Status: The major AI labs have patched several issues after responsible disclosure. Confirm that your deployed models are running the latest versions with these security fixes applied.
• Limit Model Cascading: Avoid piping outputs from premium models directly into cheaper models without inspection, especially in automated agent workflows where the connection may not be obvious to developers.

The vulnerability highlights a critical challenge as AI agents become more autonomous and interconnected. Agentic frameworks, which allow AI systems to plan, execute, and coordinate multiple steps across tools and data sources, are moving into production use across enterprises. The Model Context Protocol (MCP), a standardized way for AI applications to connect to tools and data, now has support from Anthropic, OpenAI, Google, Microsoft, and AWS.

MCP itself is designed to standardize how models access tools and resources rather than handle reasoning security. However, the protocol's growing adoption demonstrates the scale at which AI agents are now operating. By July 2026, nearly 20 percent of monthly interactive queries at Honeycomb.io came from AI agents using its MCP server, showing how widely these integrations have spread. At this scale, a single vulnerability in reasoning encryption could expose credentials and proprietary logic across thousands of agent workflows simultaneously.

The labs have begun patching the issue, but the fundamental question remains unresolved: as AI agents become more autonomous and interconnected, how do we ensure that the reasoning traces flowing between systems remain truly private? The answer will likely shape how enterprises architect their AI infrastructure and security practices over the coming year.