Researchers Found a Way to Read AI Models' 'Private' Thinking — And It's Been Leaking Passwords
Modern AI models don't just answer you — they think first, in a hidden scratchpad the model uses to reason before producing a final response. That reasoning is supposed to stay private, encrypted, and inaccessible. A research team led by Alexander Panfilov just showed that assumption doesn't fully hold.
Here's what they found, and why it matters even if you never touch the raw API.
The Setup: Models Think Before They Speak
Reasoning models — the kind behind today's top-tier AI — generate an internal chain of thought before giving you the final answer. Providers keep that scratchpad hidden by design. It's not meant to be read by the user, by other apps, or by anyone poking at the API. It's supposed to be encrypted at rest and in transit.
The researchers found a flaw in how major providers — OpenAI, Anthropic, and Google among them — expose these reasoning traces through their APIs. The flaw didn't require breaking encryption. It exploited how the API itself handled and returned that hidden state.
What They Actually Pulled Out
To test the severity, the team scanned roughly 7,000 public sessions that had gone through vulnerable API paths. What they found in that hidden reasoning:
- 62 API keys
- 33 email addresses
- 33 passwords
That's not hypothetical risk — that's real credentials sitting in text nobody thought was retrievable. The reasoning layer was treated as a black box, so nobody built the same guardrails around it that exist for normal model output.
The team also demonstrated something stranger: through a jailbreak, they got Anthropic's Claude Haiku 4.5 to transcribe, nearly word-for-word, the raw internal reasoning of the larger Claude Opus 4.8 — essentially using one model to read another model's private thoughts. Decoding roughly 10,000 full reasoning traces this way cost about $720 in API calls, which tells you the barrier to doing this at scale is not high.
Why "It's Just the Reasoning Step" Undersells This
It's tempting to shrug this off — the reasoning trace is just scratch work, right? Not the final answer, not what gets shipped to the user.
But that scratch work is exactly where models talk to themselves the way an engineer talks to themselves while debugging: unfiltered, unpolished, and sometimes copying context verbatim from whatever it was given — including credentials pasted into a prompt, tokens embedded in a tool call, or sensitive text from a document a user uploaded. The final answer gets cleaned up and safety-checked. The reasoning doesn't, because it was never supposed to leave the building.
For anyone building on top of these APIs — agent frameworks, coding assistants, internal tools that pipe reasoning traces into logs for debugging — this is a reminder that "hidden" and "secure" aren't the same guarantee unless a provider proves it.
The Providers Are Already Responding
This kind of finding is exactly what responsible disclosure is for, and it's already circulating through the usual channels — security researchers flagging it, providers patching the specific API behavior that exposed the traces. The bigger lesson is more durable than any single patch: as reasoning becomes a first-class part of what models output, it needs first-class security treatment, not an assumption that "hidden" is enough.
What This Means If You Use OpenClaw
If you run agents that call these APIs — including ones built on OpenClaw — this is a good prompt to check two things: what your agent logs from model responses (including any reasoning or debug output), and whether credentials ever get typed directly into a chat or task instead of pulled from a secrets manager.
OpenClaw's design already treats memory and tool access as things that need explicit boundaries — an agent only sees the tools and context it's been given, not a raw stream of another system's internal state. That's a smaller surface than a general-purpose API integration where reasoning traces might get piped into logs by default.
The broader trend here is one worth watching closely: as AI agents get more autonomous and handle more of your actual credentials and workflows, the security model underneath them matters as much as the capability on top. Transparency about how an agent thinks is good. Transparency it never intended to give you is a vulnerability.