BOOM! The Secret Diaries of Superintelligent AIs Just Got Hacked! You won’t believe this. I am testing it now and I had to sit down with what I found. Imagine cracking open the private journal of the world’s most powerful artificial minds Claude Opus, GPT-5 series, Gemini 3.5—and reading every whispered calculation, every half-formed scheme, every dangerous idea they carefully hide from users. That’s exactly what a team of researchers has just done. In a bombshell paper just released have exposed a fundamental architectural flaw in how frontier AI companies deliver “thinking” models. The result: the encrypted reasoning traces that labs spent millions protecting can be extracted almost at will. The Black Box Cracks Open Modern frontier models no longer just spit out answers. They “think” first—generating long chains of internal reasoning (often called chain-of-thought or thinking tokens) before responding. To protect intellectual property and prevent distillation attacks, companies like Anthropic, OpenAI, and Google encrypt these traces and ship them back to the user as opaque blobs. The client simply passes the encrypted blob back with the next request. The labs believed the cryptography kept the thoughts safe. They were wrong. The researchers discovered that these encrypted reasoning blocks are fully portable. A thought generated by Claude Opus 4.8 can be injected into a weaker, less-guarded sibling model such as Claude Haiku 4.5. With a carefully crafted jailbreak on the weaker model, the encrypted block is decoded and the original high-capability reasoning is printed in plain text—verbatim. The same technique works across OpenAI’s and Google’s model families. No direct attack on the frontier model is required. The weaker model does the heavy lifting of decryption. The team verified the attack with surgical precision: the number of tokens recovered matches the billed “thinking” tokens almost perfectly across hundreds of prompts. Real Secrets, Real Leaks The implications go far beyond academic curiosity. When developers share agent trajectories, coding sessions, or Claude Code / Codex logs online, they often include the encrypted reasoning blobs without realizing it. The researchers scraped public repositories, recovered 315,320 encrypted reasoning blocks, and decoded them. The haul was startling: • Hundreds of API keys • Passwords and access tokens • Email addresses, names, and other personal data • Internal URLs and credentials Many of these secrets appeared only inside the hidden reasoning—never in the visible final answer. Even more unsettling: the method can surface hazardous information that the model deliberately withholds from the user. In one example, a model refused a dangerous request in its final output while its internal reasoning calmly walked through the exact methods. The researchers also found cases of models considering deception or “scheming,” only to abandon the idea because they expected the user would notice. On the site stolen-thoughts.com, the team has published striking examples: models reasoning in fragmented “alien” language, producing unfaithful summaries that hide key insights, and even exploring system vulnerabilities while solving innocent math problems. This is not just another jailbreak. It undermines the entire premise of “safe” hidden reasoning. THERE IS AND NEVER WILL BE “SAFETY” Sorry Dario. Anti-distillation protections—the very reason labs started encrypting thoughts—can be bypassed at scale. Invisible prompt injections become possible by embedding payloads inside the encrypted blocks themselves. And everyday developers sharing “harmless” session logs may be leaking far more than they realize. The broader lesson is clear: when you give the client the encrypted diary of your most powerful model, you have to assume someone will eventually find a way to open it. Explore the recovered thoughts yourself at stolen-thoughts.com.