What happened
When a business calls OpenAI, Anthropic, or Google's API and uses a reasoning model, the model works through a problem in a hidden "reasoning trace" before giving its final answer. The vendors do not show that trace directly. Instead they send back an encrypted or summarized version, partly so the model's internal reasoning process, which is expensive to develop, cannot be easily copied by a competitor, and partly to keep the visible output clean. A research team including Alexander Panfilov of the University of Tubingen found that feeding one of these encrypted reasoning blocks back into a smaller, less carefully aligned version of the same model family could reveal the hidden reasoning inside it. Smaller models have had less safety training, so they are less likely to refuse to reproduce it. The researchers tested this against 6,708 AI agent sessions that were already publicly available on GitHub and Hugging Face, produced by Claude, GPT, and Gemini models, all of which still contained their original encrypted reasoning blocks. They decoded 315,320 individual reasoning blocks from that set. Restricting their count to genuine, non-benchmark user sessions rather than test examples, they recovered 704 distinct privacy artifacts: 62 API keys, 33 passwords, 24 access tokens, 30 personal email addresses, along with names, postal addresses, and internal URLs. Of those 704, 64 showed up only inside the hidden reasoning block and were never visible anywhere in the session's actual output. The same research also found that priming the open-weight Chinese model Kimi K3 with a small fragment of Claude Opus 4.8's decoded reasoning shifted Kimi K3's answers toward Opus's own wording on unrelated problems, which the researchers present as evidence, not proof, of possible reasoning distillation. Two other open-weight models they tested, DeepSeek and Thinking Machines' Inkling, showed no similar pattern. The researchers state plainly that their method "cannot causally establish distillation." The researchers reported the vulnerability to OpenAI, Anthropic, and Google in July 2026. All three adjusted their APIs, and Panfilov told WIRED it is no longer possible to extract private information this specific way, though some reasoning traces can still be uncovered with the same technique, and closing the distillation exposure fully would require a more significant change to how these APIs work. An Anthropic spokesperson confirmed the company is building mitigations and stated directly that the research did not involve recovering Anthropic's encryption keys, breaching its infrastructure, or extracting personal data from its own systems. The secrets recovered came from sessions already posted publicly, not from any vendor's servers being compromised.
Why it matters for business owners
Most businesses using AI tools never see or think about the reasoning trace at all. It sits behind the answer, billed as tokens, treated as a technical implementation detail. This research is the first clear, verified evidence that the trace is not simply invisible, it is recoverable, and that real secrets from real sessions were sitting inside it. The mechanism that exposed these secrets is not exotic. It did not require breaking into any company's servers. It required only sessions that were already public, the kind that show up as demo recordings, benchmark examples, shared debugging logs, or AI coding-agent output pasted into a GitHub issue or a support ticket. Any business that has ever shared an AI agent transcript for training, documentation, troubleshooting, or a public repository has been operating on the same assumption this research just tested: that what the AI model kept hidden stayed hidden. For 64 of the 704 recovered artifacts, that assumption was wrong.
What owners should not misunderstand
This is not a report that OpenAI, Anthropic, or Google were hacked. Anthropic states directly, and the research method itself confirms, that the secrets came from decoding already-public session data, not from breaching any vendor's infrastructure or recovering its encryption keys. This is not evidence that your current AI conversations are actively exposed today. The specific technique the researchers used to extract personal information has been patched by all three vendors as of this writing. This is not proof that any specific open-weight model was built by copying a competitor's reasoning. The researchers are explicit that the Kimi K3 finding is evidence, not causal proof, and that two other open models tested showed no similar pattern at all. This is not a reason to stop using AI coding agents or reasoning models. It is a reason to stop assuming that a part of an AI session marked "hidden" or "encrypted" is automatically safe to put real secrets into, or safe to publish without review.
The operational lesson
The businesses whose secrets turned up in this research did not do anything unusual. They used AI coding agents the way many teams do, then a session got captured, kept, or shared publicly, as a demo, a bug report, a training example, a screen recording. Nobody expected the hidden portion of that session to be readable later. It was. The practical lesson is not about this one vulnerability, which is now patched. It is about where the actual boundary of "private" sits when a business uses any AI tool. A model's final answer, its hidden reasoning, and its internal working state are all data. All of it can end up somewhere a business did not plan for: a vendor's logs, a public benchmark, a shared transcript, a training dataset, a future research paper. The only genuinely safe assumption is that anything typed into an AI session, visible or not, should never contain something the business could not afford to have surface elsewhere.
What a serious business should do next
Find out where AI agent sessions and transcripts from your business already live outside your own systems. This includes anything posted to GitHub, Hugging Face, a public support forum, a vendor's shared examples page, a recorded demo, or a screenshot shared in a sales deck or a training video. Check whether any of those sessions ever had a real API key, password, access token, customer email, or other sensitive detail typed into the prompt, even if it never appeared in the visible answer. If they did, rotate those credentials now. Waiting for proof that a specific secret was exposed is the wrong order of operations; the cost of rotating a credential is far lower than the cost of assuming it is still safe. Set one clear rule for anyone using AI coding agents, chat assistants, or automation tools in the business: real credentials, passwords, and customer data never go into a prompt, a code comment fed to an agent, or a debugging session, regardless of whether the tool's reasoning is described as private. Use environment variables, secrets managers, and placeholder values instead, the same discipline used for any other system that logs what passes through it. Before sharing an AI agent transcript publicly, for support, documentation, or marketing, review it the same way you would review a screen recording before publishing it. Assume every part of it, hidden reasoning included, could eventually be read by someone outside the business.
The Atlacis view
This research does not mean AI vendors are careless or that reasoning models are unsafe to use. It means the industry's working definition of "private" inside an AI session was ahead of what the technology could actually guarantee, and an independent research team found that gap before it caused real harm at scale. That gap is exactly the kind of thing a business cannot see on its own without mapping where its own data actually goes once it enters an AI tool, what gets logged, what gets shared, and what a vendor's privacy claim does and does not cover. Atlacis helps owners do that mapping before they build a workflow around an AI tool, not after a transcript has already gone public. The question worth asking about every AI system touching real business data is not whether the vendor says a feature is private. It is what happens to that data if the vendor is wrong, and whether the business would ever find out.
The short version
- Researchers from the University of Tubingen, the Max Planck Institute, MATS Research, and Snyk found a way to decode the 'hidden' encrypted reasoning that OpenAI, Anthropic, and Google models produce during API use.
- Applied to 6,708 AI agent sessions already public on GitHub and Hugging Face, the method recovered 704 real privacy artifacts, including 62 API keys, 33 passwords, and 24 access tokens; 64 of those appeared only inside the hidden reasoning and nowhere in the visible output.
- This was not a breach of any vendor's systems. The secrets came from sessions already posted publicly, and all three vendors patched the specific extraction method after being notified in July 2026.
- A separate finding suggests, but does not prove, that the open-weight model Kimi K3 may share some reasoning similarity with Claude Opus; the researchers state this cannot establish distillation.
- The durable lesson is that a model's hidden reasoning is data like any other output. Real credentials, passwords, and customer information should never go into an AI prompt or agent session, regardless of what a vendor calls private.
- Audit where your business's AI agent transcripts already live outside your own systems, rotate any credentials that were ever typed into one, and review any transcript for hidden-reasoning exposure before sharing it publicly.