The Brief
Issue 11 · 17 August 2026
704 real secrets pulled from AI's 'hidden' reasoning. 64 were never shown to anyone.
A new paper shows the 'hidden' reasoning behind Claude, GPT-5.6 and Gemini 3 can be forced into plaintext. Two more disclosures from the same fortnight, plus the UK opens its first sector-specific AI sandbox, for legal services.
A paper published 10 August by researchers at the ELLIS Institute Tübingen and the Max Planck Institute for Intelligent Systems found that the encrypted 'reasoning trace' blocks returned by OpenAI, Anthropic and Google's APIs are interchangeable across sessions, users, and even models within the same provider's line-up. Replay a flagship model's encrypted reasoning block into a weaker sibling model, and the sibling decrypts and outputs that hidden reasoning in plain text, bypassing the flagship's own safety and anti-distillation guardrails entirely.
The researchers scanned 6,708 public agent transcripts on GitHub and Hugging Face and decoded 315,320 reasoning blocks. Restricted to genuine user sessions, that yielded 704 real privacy artifacts, 62 API keys, 33 passwords, 24 access tokens, 7 private keys and 30 personal emails, sitting in reasoning the vendors describe as encrypted and private. Most of it also turned up somewhere in the visible response, but 64 of the 704 were found nowhere else at all: never shown to the user, never logged anywhere except the reasoning the model was never supposed to expose.
OpenAI and Anthropic had dismissed an earlier report of the underlying replay flaw, from May, as carrying no security implications. This paper is the practical exploit at scale that report warned about. All three vendors have since shipped server-side mitigations, and the original proofs of concept no longer reproduce.
Two more from the same fortnight
Agentic browsers. Zenity Labs disclosed 'PleaseFix' at Black Hat USA on 5 August: hidden instructions in ordinary web content can zero-click hijack agentic AI browsers, Claude in Chrome and Gemini in Chrome named specifically, alongside Comet, Atlas and Copilot Edge, leading to credential theft, account takeover and remote machine control. Vendor patching is uneven so far.
CI/CD agents. Also at Black Hat, Novee Security disclosed critical flaws in three AI coding agents used in CI/CD pipelines. Gemini CLI (CVE-2026-12537, CVSS 10.0, OS command injection via a crafted config file) and Claude Code (CVE-2026-54316, an API key exfiltrated one character at a time via a Hugging Face download-counter side channel) are both now patched; OpenAI Codex was mitigated through workflow separation. A GitHub issue from a zero-privilege account was enough to reach CI secrets in every case.
The UK opens a sandbox while the EU keeps enforcing
The UK's DSIT opened its Advisory AI Growth Lab to legal services on 3 August, the first sector admitted to the scheme, with the Legal Services Board, Council for Licensed Conveyancers and SRA providing supervised guidance. Applications close 27 September, decisions are expected by the end of October, and participation runs up to nine months.
It's a genuinely different posture from Article 50's binding disclosure duties, covered in our last issue: supervised experimentation rather than a compliance deadline. Firms that want a formal, government-backed setting to test AI use in litigation or conveyancing now have one, at least for the next round of applicants.
Two disclosure deadlines land quietly in the region
Australia's Privacy Act amendments get teeth on 10 December: from that date, APP entities using personal information in automated decision-making that could significantly affect someone's rights or interests must disclose, in their privacy policy, what kind of information feeds the decision and broadly how it's made. Legal commentary reads the obligation as applying regardless of when the system was built or deployed, no exemption flagged for models already in production. The OAIC ran a consultation on its guidance through mid-June and hasn't yet confirmed a publication date.
Singapore's PDPC finalised its generative-AI guidelines on 20 July, at the Singapore Data Festival, closing a consultation opened in June. Rather than a single AI law, it maps existing data-protection duties onto three stages of the AI lifecycle, development, deployment and post-deployment, assigning distinct obligations to model providers, system providers and deployers, including how to handle correction requests against training data itself.
Our read
Three separate disclosures this fortnight share one root cause: agentic AI systems expose more than their visible output suggests, hidden reasoning, browsed web content, and CI credentials all became attack surfaces because something in the pipeline trusted input it shouldn't have. It's why a closed, grounded platform that doesn't browse the open web or execute code on your behalf isn't just a confidentiality preference, it's a structurally smaller attack surface. The UK's new sandbox is trying to close a different gap, from the regulatory side, supervised experimentation instead of a straight deadline. Neither helps if the tool itself is the leak.
Get the next issue in your inbox