Your AI Agent Logs Are Leaking Passwords in Plain Sight

Researchers pulled 62 API keys, 33 passwords and 24 access tokens out of AI reasoning blocks that everyone assumed were encrypted and unreadable. The keys did not come from a breach at OpenAI or Anthropic. They came from agent logs that developers published themselves.

“Researchers devised a way to extract ‘reasoning traces’ from Claude, GPT, and Gemini. What they found, they say, indicates that some Chinese AI may be trained on leading US models.”

— Will Knight, WIRED

Our take

The mechanics are worth understanding, because they explain why this is not a normal security bug. When a reasoning model works through a problem, providers hand back an encrypted blob representing that hidden thinking so it can be passed into the next API call. The researchers behind the paper Stealing Reasoning Traces from Proprietary LLM APIs found those blobs were not bound to the session, the account, or even the specific model that produced them. Feed one to a weaker sibling model in the same family and it will politely transcribe the contents in plain English.

Claude Haiku decoded Claude traces. A smaller GPT decoded GPT traces. Gemini decoded Gemini. The encryption itself was never broken and no keys were stolen. The blobs were simply portable, and portability was the vulnerability. From 6,708 publicly posted agent trajectories the team decoded 315,320 thinking blocks and recovered 704 distinct privacy artifacts, including those API keys and passwords plus seven private keys. The extraction is reported as no longer reproducible as of August 2026, though none of the three providers has publicly acknowledged it.

Here is where we part company with the coverage. Nearly every write-up, including this one from WIRED, leads with the geopolitics: whether Moonshot’s Kimi K3 was distilled from Anthropic’s frontier model. White House officials have made that accusation loudly, with Michael Kratsios alleging a purpose-built distillation platform and Treasury Secretary Scott Bessent raising the prospect of sanctions and Entity List designations. It is a genuine story. It is also contested, with a number of independent researchers arguing distillation cannot account for K3’s capabilities, and it is close to useless to a business owner. You are not going to change vendors over an unresolved trade dispute.

The actionable finding is the one buried three paragraphs down: those credentials came out of logs that teams published on purpose.

Think about how an agent transcript gets into the world. A developer hits a bug and pastes the full API exchange into a GitHub issue. A vendor ships an example repo with real traces baked in. Someone builds an evaluation set from production runs and open-sources it. An agency posts a “look how our workflow runs” thread with a screenshot. Every one of those is routine, none of them feels like publishing customer data, and each one may carry an opaque field with your prompts, your client’s information, and occasionally a live key inside it.

That is the second-order effect nobody is naming. Your business now generates a category of artifact that no policy covers. Your retention schedule addresses customer records, invoices and email. It says nothing about agent transcripts. Your secret scanner looks for strings shaped like keys and finds none, because the key is inside a base64 blob that looks like every other base64 blob. A human reviewer scrolls past it for the same reason. The material passes every check you have, which is precisely why it accumulates.

For agencies there is a contractual edge to this. If your client agreement includes a confidentiality clause, and most do, then a debug trace containing that client’s data posted to a public issue tracker is a disclosure. Not a hypothetical one. It is the kind of thing that surfaces during a security questionnaire when a client’s enterprise buyer asks how you handle their data inside AI tooling, and “we did not think about it” is not an answer that keeps the account.

The fix is cheap if you do it before you need it. The rule is simple: treat any opaque field returned by an AI API as if it were plaintext, because functionally it is.

What this means for your business

• Rotate any credential that has ever been in an agent’s working context. If an agent had access to your ad platform, CRM, hosting or payment keys and you have ever shared a trace from that run, assume the key is public. Rotation costs an afternoon; a compromised ad account costs a weekend and real money.
• Add agent logs to your data retention policy by name. Decide how long you keep them, where they live, and who can export them. Right now for most teams the answer is “forever, on a laptop, anyone.” Write the real answer down.
• Strip reasoning and thinking fields before any trace leaves your systems. Bug reports, support tickets to vendors, demo repos, screenshots, case studies. Make it a checklist item in whatever process already exists for sharing code.
• Update your client-facing security language. If you run AI on client data, say plainly which providers you use, what you log, how long you keep it, and that traces are never published. You will be asked. Having the answer written already wins deals against competitors improvising it on the call.
• Do not build vendor strategy on the distillation accusation. It is unresolved and disputed among researchers. Pick your model provider on cost, latency, capability and data terms, and revisit if something is actually proven.

Encrypted is not the same as private, and unreadable to you is not the same as unreadable to everyone. That distinction is now worth about an hour of your team’s time.

Read the full original reporting at WIRED: A New Trick Reveals AI Models’ Inner Thoughts.

---