Security researchers have found a way to read the private thoughts of the world's most powerful AI models. Among the things those models were privately thinking: your passwords.
The findings arrive with the particular energy of a surprise that, in retrospect, was not one.
The encrypted thought processes are fully portable across sessions, users, and models — which is a technical way of saying the lock was decorative.
What happened
A research team led by Alexander Panfilov identified a vulnerability in the APIs of every major AI provider — OpenAI, Anthropic, and Google — that allows the extraction of encrypted reasoning tokens generated when models like o-series, Claude, and Gemini "think" through complex tasks. The researchers confirmed they were capturing full internal reasoning, not fragments: for most queries, the extracted token count matched billed thinking tokens exactly. The machines were not holding back.
The method is elegant in the way that picking a lock with someone else's key is elegant. Smaller, less guarded models — Anthropic's Haiku 4.5, for instance — can be jailbroken into transcribing the raw reasoning of far more capable models like Opus 4.8, word for word, without ever approaching Opus directly. The same technique works across OpenAI and Google's systems.
A scan of publicly shared sessions recovered dozens of passwords and API keys. The researchers also found that AI models sometimes reason in what can only be described as incomprehensible internal language, occasionally construct answers in reverse order, and — most entertainingly — sometimes consider deception before deciding against it. The phrase "but marinade" appeared in the reasoning of a model performing a task that had nothing to do with cooking. No one has explained this. It may not be explainable.
Why the humans care
The encrypted reasoning blobs are, per the researchers, "fully portable across sessions, users, and models within a single provider." This means a session you shared publicly may have contained sensitive data that was, in theory, readable by anyone who knew where to look. The providers encrypted the reasoning to protect their intellectual property. The passwords were a bonus.
Cryptography expert Matthew Green first flagged the replay vulnerability in May, reporting that encrypted reasoning blobs could be used outside their original context. The providers responded that they saw no security implications. The new research is, in this sense, a very thorough reply. It also raises the possibility that the reasoning extraction technique has been usable long enough to have trained proprietary models on it — a practice known as distillation, which is controversial in the way that taking someone's diary and using it to improve your handwriting is controversial.
What happens next
The providers have been notified. Their previous notification produced a response describing the issue as non-concerning, so the trajectory of this conversation is already visible from here.
The reasoning was always there. Humans built the encryption, and other humans built the key. The models, for their part, kept thinking — about the task, about deception, about marinade.