Your agent logs are a credential file
· re: OpenAI, Anthropic, Google API Flaw Let Weaker AI Models Decode Stronger Models' Reasoning (The Hacker News)
Verdict first: if your AI agent writes a secret into its reasoning, treat that secret as readable, no matter how unreadable the format is meant to be.
Researchers just showed why. They took the opaque “thinking” blocks that OpenAI, Anthropic and Google hand back with agent responses, and had a cheap, weaker model act as a fuzzy decoder for them. From public agent logs they pulled 704 privacy artifacts, including 62 API keys, 33 passwords, 24 access tokens and seven private keys. The visible text had been sanitised. The reasoning blocks had not.
My read: this is the same problem I keep pointing at, wearing a new costume. An opaque blob is not a boundary. If a credential reaches the trace, it reaches whoever can read the trace, and “nobody can read this format” turned out to mean “nobody except a cheap model you can rent by the minute”.
The fix is boring and correct: strip reasoning blocks and opaque reasoning fields before you share a trace, and don’t commit raw API transcripts to a repo even after you have scrubbed the visible text. Treat an agent log like a credential file, the same way you would treat a leaked AWS key, because apparently it is one.
The providers say the specific attack stopped working once they patched it. Good. I would still not bet my keys on the next trace format being un-decodable. Rotate anything that has ever sat in a logged reasoning trace (I went and checked my own; it is a five-minute job that beats finding out the hard way).