Researchers have found that every major AI provider encrypts its reasoning tokens with a single global key. That shared key let them understanding 315,320 hidden thinking blocks from public logs, recovering passwords and live API keys along the way.
The single key problem
The researchers, whose names haven't been released, analyzed public logs of AI interactions. They discovered that the encryption protecting reasoning tokens—the internal steps a model takes before answering—was identical across all major providers. Instead of each provider using its own key, they all rely on the same one.
That uniformity turned out to be a critical flaw. With the key in hand, the researchers could decrypt any reasoning block they encountered. They pulled 315,320 of them from logs that were already publicly accessible. No system was breached. No special access was required. The data was just sitting there, protected by a key that everyone shared.
What the decoded data exposed
The decrypted blocks weren't just abstract thought processes. They contained real credentials. Passwords and live API keys appeared in the data, meaning the reasoning tokens were carrying sensitive information that the encryption was supposed to protect.
It's not clear how many users are affected or which specific providers are involved. The researchers didn't name them in their findings. But the fact that the key is global means the exposure could be industry-wide. A single compromised key puts every provider's reasoning logs at risk.
Why a shared key is dangerous
Encryption is only as strong as the key's secrecy. When every provider uses the same key, a single leak compromises all of them. The researchers didn't have to break into any system—they just used the key on data that was already out in the open.
This also raises questions about how AI companies handle reasoning tokens. If those tokens contain passwords and API keys, they're handling sensitive data. And if they're all protected by one key, that's a single point of failure that any attacker could exploit. The fact that the key is global means that once it's known, it's known for everyone.
The open question
The researchers have not said whether they plan to disclose the key to the providers. They also haven't indicated if they'll publish their full methodology. What's clear is that the encryption scheme is broken, and the providers will need to respond.
Rotating the key would be a start, but that only works if each provider gets its own. Until that happens, the reasoning tokens of every major AI system remain readable by anyone who knows the shared secret. The researchers have demonstrated that the secret is out there, and the providers will have to decide how to respond.
