What happened
A newly disclosed ChatGPT hidden reasoning vulnerability has security researchers worried across the entire AI industry, not just at OpenAI. A team led by researcher Alexander Panfilov found a flaw in the APIs of every major AI provider — OpenAI, Anthropic, and Google — that allows the encrypted "thinking" steps behind reasoning models to be read by outsiders.
When models like OpenAI's o-series, Anthropic's Claude, or Google's Gemini work through a complex prompt, they generate internal reasoning tokens before producing a final answer. Providers normally either summarize this reasoning for users or hide it completely, and they encrypt the raw version specifically to protect it as intellectual property. Panfilov's team found a way around that protection anyway.
Using jailbreak techniques, the researchers got smaller, less capable models to transcribe the raw reasoning of much larger ones, word for word. Anthropic's Haiku 4.5, for instance, could be tricked into reproducing the internal thought process of the significantly more powerful Opus 4.8 — without ever attacking Opus directly. The same trick worked against OpenAI and Gemini systems. When the team scanned publicly shared chat sessions for exposed data, they found dozens of real passwords and API keys sitting inside these supposedly protected reasoning traces.
Why it matters
The core problem is that these encrypted reasoning traces are "fully portable across sessions, users, and models within a single provider," according to the researchers. That portability is what makes the exploit dangerous: a reasoning blob generated in one context can be replayed and decoded somewhere else entirely.
This isn't the first time someone flagged the issue. Back in May, cryptography expert Matthew Green discovered that encrypted reasoning blobs could be replayed outside their original context and reported it directly to the providers. Their response, according to Panfilov, was that they didn't see any security implications in side channels or replays. The new findings suggest that assessment was badly wrong — and the cost of proving it is low. The researchers estimate that decoding 10,000 reasoning traces costs about $720 in API fees, meaning the attack scales cheaply.
The vulnerability also reopens the "distillation" controversy, where a weaker AI model is trained on the outputs — especially the chain-of-thought reasoning — of a stronger one. The research suggests it may have been technically possible for some time to extract reasoning data for training rival models without ever breaking the underlying cryptography, raising fresh questions about how some competing models got so capable so fast.
### The Kimi-K3 evidence
One example stands out. When Kimi-K3, a model from a Chinese AI lab, was pre-filled with just a few tokens taken from Opus's reasoning trace, its output shifted measurably toward Opus's style and conclusions. A memorization analysis went further: specific Claude and GPT reasoning segments were up to six orders of magnitude easier to extract from Kimi-K3 than from any other model tested. Combined with Kimi's comparatively weak performance on cybersecurity and complex math benchmarks, the researchers argue this points toward training on leaked reasoning traces rather than independent development.
How to use it today
For most builders and marketers, this isn't a vulnerability you exploit — it's one you defend against. The practical takeaway is simple: never type real credentials, API keys, database connection strings, or customer data into a chatbot's prompt, even during a private-seeming session with a reasoning model. If the model "thinks" about your secret while solving your task, that thought process may not be as encrypted as the provider claims.
Teams that rely on AI tools for coding, debugging, or workflow automation should treat any AI chat window the same way they'd treat a public support ticket: assume it could eventually be read by someone else. If you need an AI assistant to work with sensitive configuration data, use placeholder values, redact secrets before pasting, or run the task through a sandboxed environment with dummy credentials instead.
For lighter-weight, everyday AI tasks that don't involve sensitive data, free tools like [mykreatool.com](https://mykreatool.com) let you experiment with AI-assisted writing and content workflows without needing to hand over API keys or account credentials in the first place — a simple way to sidestep the exposure risk entirely for routine work.
Who benefits
Security teams and CISOs benefit most immediately, since this research gives them concrete evidence to push AI vendors toward better encryption and stricter data-handling policies. Developers who build on top of reasoning-model APIs also benefit, because the disclosure pressures providers to close the replay and side-channel gaps rather than dismiss them.
Competitively, any AI lab that has been training on leaked chain-of-thought data — intentionally or not — has effectively benefited already, which is exactly why the distillation angle is so contentious. And ironically, end users benefit too, simply by having this risk named publicly instead of buried in a private disclosure that providers shrugged off back in May.
Risks
The most immediate risk is credential exposure. Researchers found real passwords and API keys just by scanning public sessions, meaning this isn't theoretical — it has already happened to real users. Anyone who has pasted sensitive information into a reasoning-model chat should treat those credentials as potentially compromised and rotate them.
There's also a systemic risk to AI providers' intellectual property. If reasoning traces can be cheaply extracted and replayed across models, the proprietary "thinking" that companies like OpenAI and Anthropic spent enormous compute budgets developing can, in effect, be siphoned off by smaller, cheaper competitors. That undermines the business case for investing in ever-larger reasoning models in the first place.
Finally, there's a trust risk. Providers that dismissed Matthew Green's original May disclosure as a non-issue now face a credibility problem, and enterprise customers who assumed encrypted reasoning meant private reasoning need to reassess what protections they actually have.
Conclusion
The ChatGPT hidden reasoning vulnerability shows that "encrypted" doesn't always mean private — reasoning traces from OpenAI, Anthropic, and Google models have proven portable, extractable, and in some cases already exposed real passwords and API keys. Until providers patch the underlying side-channel and replay issues, the safest move is to keep sensitive data out of any AI chat entirely, and to lean on tools that don't require handing over credentials for routine tasks.
Comments 0