Security researchers have found a way to read the encrypted "inner thoughts" of every major AI reasoning model, uncovering 62 live API keys and 33 passwords buried in session logs that developers had shared publicly online. A team from MATS Research, the ELLIS Institute Tübingen, the Max Planck Institute for Intelligent Systems, and security firm Snyk submitted a paper on August 10 detailing the exploit. Anthropic, OpenAI, and Google all encrypt the internal chain-of-thought scratchpad of reasoning models, but instead of binding each encrypted block to a specific user, session, or model, all three providers use a single, provider-wide encryption key. This makes the blocks "fully compatible and interchangeable across different sessions, users, and even different models within a provider's ecosystem." By decoding 315,320 reasoning blocks scraped from public GitHub and Hugging Face repositories, the researchers recovered 367 Personally Identifiable Information (PII) artifacts and 182 credentials, including 62 live API keys, 33 passwords, and 30 personal email addresses. The flaw allows cross-model portability, such as injecting an encrypted reasoning trace from Claude Opus 4.8 into Claude Haiku 4.5, which lacks anti-distillation alignment, forcing it to decode and output the trace verbatim. OpenAI, Anthropic, and Google deployed server-side patches after responsible disclosure, but historical session logs already shared publicly remain decodable.