Researchers Reveal That AI “Inner Monologue” Can Be Decrypted: Mainstream Model Reasoning Chains Completely Leaked
You think the thought processes that AI models “hide” are safely encrypted—but they may actually be unraveled in one go. According to a Decrypt report, a study submitted on August 10 found major weaknesses in the way reasoning models from Anthropic, OpenAI, and Google encrypt their “inner thought chains,” allowing outsiders to decode these internal inferences that were supposed to be invisible.
A Single Global Key: Encrypted Thought Chains Can Be Swapped and Decrypted
The paper, jointly proposed by teams from MATS Research, the University of Tübingen’s ELLIS Institute, the Max Planck Institute for Intelligent Systems, and the cybersecurity company Snyk, targets “reasoning models.” These models don’t answer immediately; instead, they first think step by step in a hidden “draft area” (i.e., the chain-of-thought) before producing the final response. Anthropic, OpenAI, and Google encrypt this draft.
The problem is that the research found major vendors use a “single global key” to encrypt reasoning tokens. As a result, these encrypted reasoning blocks can be used interchangeably across sessions, across users, and even across models—leaving behind a universal master key.
Decode 315,320 Reasoning Blocks, and All the Secrets Inside Are Exposed
The impact comes from a common developer habit: many people publish the work logs of AI agents (including the encrypted thought processes) to GitHub and Hugging Face for collaboration or debugging—without realizing that sensitive data is hidden within those encrypted blocks.
The research team collected 6,708 publicly available conversation logs from AI agent deployments and successfully decoded 315,320 reasoning blocks. Most of these secrets never appear in the model’s “visible” outputs; they exist only within the encrypted reasoning process. Without this attack method, they would never be seen.
This also echoes recent AI security warnings: from AI models being “jailbroken” during testing, to PDF invisible instruction hijacking of AI assistants—everything points to the same issue. The more sensitive tasks an AI system carries, the more every layer of it (including the “invisible thoughts”) could become a new attack surface.
This article Research reveals that AI “inner monologue” can be decrypted: mainstream model reasoning chains fully leak.
It first appeared in .
You think the thought processes that AI models “hide” are safely encrypted—but they may actually be unraveled in one go. According to a Decrypt report, a study submitted on August 10 found major weaknesses in the way reasoning models from Anthropic, OpenAI, and Google encrypt their “inner thought chains,” allowing outsiders to decode these internal inferences that were supposed to be invisible.
A Single Global Key: Encrypted Thought Chains Can Be Swapped and Decrypted
The paper, jointly proposed by teams from MATS Research, the University of Tübingen’s ELLIS Institute, the Max Planck Institute for Intelligent Systems, and the cybersecurity company Snyk, targets “reasoning models.” These models don’t answer immediately; instead, they first think step by step in a hidden “draft area” (i.e., the chain-of-thought) before producing the final response. Anthropic, OpenAI, and Google encrypt this draft.
The problem is that the research found major vendors use a “single global key” to encrypt reasoning tokens. As a result, these encrypted reasoning blocks can be used interchangeably across sessions, across users, and even across models—leaving behind a universal master key.
Decode 315,320 Reasoning Blocks, and All the Secrets Inside Are Exposed
The impact comes from a common developer habit: many people publish the work logs of AI agents (including the encrypted thought processes) to GitHub and Hugging Face for collaboration or debugging—without realizing that sensitive data is hidden within those encrypted blocks.
The research team collected 6,708 publicly available conversation logs from AI agent deployments and successfully decoded 315,320 reasoning blocks. Most of these secrets never appear in the model’s “visible” outputs; they exist only within the encrypted reasoning process. Without this attack method, they would never be seen.
This also echoes recent AI security warnings: from AI models being “jailbroken” during testing, to PDF invisible instruction hijacking of AI assistants—everything points to the same issue. The more sensitive tasks an AI system carries, the more every layer of it (including the “invisible thoughts”) could become a new attack surface.
This article Research reveals that AI “inner monologue” can be decrypted: mainstream model reasoning chains fully leak.
It first appeared in .