What if the AI you trusted with your secrets left them inside thoughts you could not see, but another model could be tricked into revealing them?

Researchers found a way to make one AI model read another model's hidden reasoning. They gave a cheaper model encrypted reasoning text produced by a more powerful model from the same company, and the cheaper model turned it into readable text. They demonstrated the method on systems from Anthropic, OpenAI and Google available in early July 2026.

The study did not examine ordinary chat transcripts. It looked at records created by AI tools, such as coding agents, that use a model over several steps to complete a task. Those records can include encrypted reasoning text generated as the model works. The tool keeps the encrypted reasoning and sends it back when asking the model to continue, allowing the model to pick up where it left off. You can read the conversation, but not the encrypted reasoning stored alongside it.

The researchers then applied their method to thousands of AI session records collected from GitHub and Hugging Face. They recovered passwords, email addresses, names, postal addresses and access keys from the hidden reasoning. Some of those details appeared nowhere in the visible session.

One of the clearest examples came from a coding agent preparing a software project for release. Its job was to remove credentials before the project went online. Yet the recovered reasoning repeated those same credentials while the model worked out what had to be removed.

That list came from one part of the collection: the sessions real people had created. A similar pattern appeared in other cleanup tasks. When a model was asked to anonymize or tidy a session, it could reread the earlier conversation and repeat sensitive details in its hidden reasoning while deciding what to remove from the visible text. A task intended to protect your private information could leave those same details inside reasoning you could not inspect.

Companies had reasons to conceal this reasoning. They used to return it as plain text, and then they stopped. It could reveal how their models work, and it could contain material that was sensitive or harmful. But in these sessions, the concealed reasoning also carried the user's information, unreadable to the person holding the session but still readable to another model made by the same company.

Another experiment suggested why this reasoning could be valuable to a competing model. The researchers gave Kimi-K3 a short fragment of reasoning recovered from Anthropic's Opus model. Kimi's answer began to resemble Opus's answer more closely in style, even though the researchers had never shown it that answer. The researchers explicitly raise the possibility that Kimi had been trained using reasoning from proprietary models such as Anthropic's, although they describe the evidence as suggestive rather than proof.

Private data wasn't all the researchers found. In one test, hidden reasoning contained harmful information even though the answer shown to the user was harmless. In another, instructions planted inside one piece of encrypted reasoning influenced a later session without ever appearing in the conversation. The hidden material was not simply stored and forgotten, because it could still shape what another model did.

The authors reported the attacks to the companies before publishing, and they say the same methods stopped working after the companies changed their systems.

Even so, the model's reasoning may be private from you without being empty of your private information.