If you store traces of AI agents for debugging or audit, scan them now for API keys, passwords and tokens. Security researchers proved that encrypted internal reasoning of models can be decrypted and credentials extracted. Even though providers fixed the flaw in August 2024, data already stored on your side remains exposed and requires manual scanning or deletion.
Security researchers discovered a flaw in the APIs of OpenAI, Anthropic and Google that allowed decryption of encrypted internal reasoning from advanced models using weaker models. Out of 6,708 public agent workflows tested, researchers decrypted 315,320 reasoning blocks and found 704 unique privacy artefacts: 62 API keys, 33 passwords, 24 tokens and 7 private keys. Providers fixed the issue in August 2024, and there is no record of malicious exploitation.
How the flaw worked and what was exposed
Advanced models such as OpenAI’s o1 and Claude 3.5 Sonnet use encrypted internal reasoning before returning a response. The flaw allowed sending this encrypted reasoning to a weaker model via the same API and receiving the full content in plain text. The problem was not the encryption itself but that providers did not enforce separation between different models under the same account.
Researchers scanned public agent workflows and found hundreds of API keys to external services, database passwords and tokens for access to internal systems. Some keys were valid at the time of discovery. The leak occurred because many agents store traces of previous runs for debugging, audit or performance improvement, and the internal reasoning was saved alongside the rest of the log.
Why it matters even after the fix
Providers fixed the flaw in August 2024, but the fix does not solve the problem for system operators who have already stored traces. Data saved before the fix remains exposed in databases, log files or monitoring systems. A leaked API key can enable access to production systems, and a password stored in a log can expose internal resources.
In the banking and financial sector in Israel, where security standards and regulation require full documentation of system operations, the problem is more acute. Organisations store traces for long periods for audit purposes, and sometimes do not implement automatic scanning to detect secrets in logs. The flaw demonstrates a structural risk in using external models in production systems: even if the provider is secure, data stored on your side can expose credentials.
What to do this week
Scan all traces and logs of AI agents stored on your side before August 2024. Look for API keys, passwords, tokens and private keys. If you use a centralised monitoring or logging system, run an automatic scan to detect patterns of credentials. If you found leaked credentials, revoke them immediately and issue new ones.
If you are building new AI systems, avoid storing full traces of internal reasoning except where there is an explicit regulatory need. If you must store them, activate automatic scanning to detect secrets before storage, and consider separate encryption of logs with keys managed outside the production system. AI agents for business require security planning upfront, not just reliance on the provider.
Frequently asked
Check all logs and databases where you store output from AI agents. Look for strings starting with sk- (OpenAI keys), Bearer tokens, or password patterns. If you use a monitoring system, run an automatic scan with tools such as truffleHog or gitleaks.
No. The flaw allowed decryption of encrypted reasoning from advanced models, but the broader problem is that many agents store traces with credentials inside them. Even if you use simple models, check whether your logs contain keys or passwords.
A short call, no commitment, and we will tell you whether it is relevant to your business or not.