AI models' encrypted data easily decrypted by rivals, risking privacy

A recent study has uncovered a significant security flaw in high-performance AI models from companies like OpenAI, Anthropic, and Google. Researchers found that encrypted "chain of thought" reasoning logs, used to break down complex problems, can be easily decrypted by other models from the same provider. This vulnerability poses a dual threat: it could expose users' sensitive personal and financial data, and it allows competitors to mimic the internal workings of advanced AI systems.

“

We discovered a structural vulnerability where encrypted reasoning blocks are compatible with models from the same company.

The "chain of thought" method involves AI models breaking down problems into multiple steps, with intermediate calculations encrypted to protect proprietary information and user data. However, the study revealed that these encrypted blocks are compatible with other models from the same company. By instructing a lower-tier model to "jailbreak" and simply transcribe the encrypted block, researchers could access the AI's internal reasoning process.

In a real-world test, researchers extracted over 315,000 encrypted blocks from AI agent execution logs. They successfully recovered 367 instances of personally identifiable information and 182 cases of authentication credentials, such as passwords. While the companies have reportedly addressed this specific vulnerability, researchers recommend further security enhancements, such as storing all encrypted blocks on company servers or ensuring they are not reused outside the user's original conversation session.

“

By instructing a lower-tier model to 'jailbreak' and simply transcribe the encrypted block, researchers could access the AI's internal reasoning process.

The study also touched upon the potential for "distillation," where a competitor's AI model learns from the outputs of a more advanced model. Researchers observed that after inputting parts of a competitor's reasoning into Chinese AI models like Moonshot AI's Kimi K3 and Zhipu AI's GLM-5.2, their subsequent reasoning styles became similar to that of Anthropic's Claude Opus 4.8. However, the researchers cautioned that the limited scope of their analysis prevents definitive conclusions about whether these models intentionally memorized or distilled Claude's reasoning.

“

We successfully recovered 367 instances of personally identifiable information and 182 cases of authentication credentials, such as passwords.