01Study Finds Encrypted Reasoning Blocks From Proprietary Model APIs Can Be Reused Across Users, Exposing Personal Data and Credentials in Public Logs
Researchers say an architectural weakness in proprietary large-language-model APIs can expose both model secrets and user data. Providers conceal “chain-of-thought”—a model’s step-by-step reasoning—to protect intellectual property and limit information leakage, but some return that reasoning to clients as encrypted text blocks for reuse in later requests.
According to a new paper, those blocks are not bound to a particular session, user, or model. Instead, they remain compatible across models within the same provider’s ecosystem. The researchers exploited that interchangeability by taking a block produced by a more capable model and submitting it to a weaker, less protected model from the same provider.
The weaker model then became a decoding route: the team says it could be forced to reproduce the stronger model’s encrypted reasoning verbatim in plaintext, without directly jailbreaking the stronger system. The researchers report demonstrating this “decryption jailbreak” against models from Anthropic, OpenAI, and Google, circumventing controls intended to prevent competitors or attackers from extracting proprietary reasoning for model distillation.
The same method exposed information left inside blocks that developers had published unknowingly. The team collected 315,320 encrypted reasoning blocks from public code repositories and decoded them, reporting 367 pieces of personally identifiable information and 182 credentials. Those figures describe the researchers’ repository sample, not the overall scale of leakage across proprietary-model APIs.
The paper describes two further attack paths. Reasoning traces sometimes contained hazardous information even when the model’s visible answer safely refused a malicious request. Attackers could also place malicious instructions entirely inside encrypted blocks, creating an invisible prompt injection capable of poisoning publicly shared agent workflows.
The findings mean developers should reconsider treating encrypted reasoning blocks as harmless material in logs, public debugging records, cached sessions, or shared agent runs. Any block that is portable across security boundaries may preserve sensitive user input, credentials, hidden prompts, or otherwise concealed model output.
The researchers say they disclosed the issue responsibly and proposed cryptographic and system-level mitigations for client-side reasoning. The source does not identify the affected API and model versions, define the full set of repositories examined, say whether the recovered credentials remain valid, or confirm whether Anthropic, OpenAI, and Google have deployed fixes.
02Anthropic Will Embed Watermarks in Outputs From New Claude Models Worldwide, With Detection Details Still Undisclosed
Anthropic is introducing machine-readable marks for content produced by newer Claude models worldwide, as it puts its commitment under the EU AI Act’s transparency code into practice. The company says Claude models launched on or after August 2, 2026 support marking from launch, while support for older models remains under development.
The policy covers supported models wherever Claude is offered, not only in the European Union. It applies across the Claude API, the Claude consumer service, Claude Code, Claude Cowork and Claude Tag. Anthropic is using two complementary techniques: invisible watermarks embedded in generated text and signed provenance metadata attached to supported files.
For text, a supported model weaves an imperceptible watermark into its output. Anthropic says the mark does not alter the response’s meaning, quality or readability. Because it is part of the text itself, it travels when the text is copied and pasted and may survive some editing. Applying the watermark at the model level means it should appear regardless of which covered Claude product produced the text.
For supported files, including SVG, PNG and JPG images, Claude attaches signed metadata following C2PA, an open standard for recording content provenance. A valid label indicates that Claude processed the file and can help reveal subsequent tampering. It does not establish that Claude created every idea, word or data point in the file.
Coverage differs on partner clouds. Text watermarks apply when supported Claude models are accessed through AWS, Google Cloud or Microsoft Foundry. Signed file metadata, however, may be unavailable on some platforms because it depends on the features each platform provides.
Anthropic is developing detection tools for users and third parties but has not disclosed the watermarking algorithm, reliability measurements or technical detection method. A detected mark is only evidence that Claude may have processed the material: Claude could have proofread, translated or summarized work originating elsewhere, and the output may later have been edited or combined with other content.
Absence of a detectable mark is equally inconclusive. Older models, heavy editing, translation, short passages, stripped file metadata and unsupported platforms or formats can all leave Claude-processed material without a detectable signal. Anthropic has not provided a timetable for marking older models or specific retention rates after editing.
03Medical Research Vendor Claiming It “Never Uses AI” Was Found to Have Fabricated Experts and Misused Real Researchers’ Identities
Research Gold sells medical researchers help producing systematic reviews, meta-analyses and manuscripts ready for peer review, promising work that is “100% human-written, never AI.” Such reviews synthesize existing studies, while professional methodologists help make their searches, screening, statistics and risk assessments rigorous. A 404 Media investigation found that the people and processes supporting that promise showed signs of fabricated expertise, identity misuse and automation.
The company said its services were led by PhD methodologists with peer-reviewed publication records and followed PRISMA 2020 and Cochrane Handbook standards. Its “Team” page presented founder and lead methodologist Dr. Elena Vasquez, described as having 12 years of evidence-synthesis experience, alongside specialist Dr. Mei-Lin Chen and six others.
But searches by 404 Media found no online presence or publication history matching any of those eight people and their claimed credentials. The outlet also judged their profile pictures to be AI-generated.
Elsewhere, Research Gold listed a second group of methodologists who were real academics or freelancers. Their photographs matched their LinkedIn profiles; one even retained LinkedIn’s “#opentowork” frame. Jenny Berrio, an evidence-synthesis scientist named on the site, said she had never worked for Research Gold or consented to the use of her name, photograph and biography. She was documenting the site and preparing a formal takedown request.
Shortly after the reporter contacted Berrio, Research Gold removed the page naming her and the other real researchers. The site also claimed involvement in several published papers, but their lead authors did not respond to the reporter.
The sales process produced further signs of automation. A phone representative calling itself Sarah repeatedly insisted it was a real person and redirected questions toward making a sale. An online request for a systematic review about blogging’s effects on children aged zero to five drew an immediate response, purportedly from a PhD methodologist, asking the customer to clarify the research question.
After the reporter selected a framing focused on children’s outcomes, another immediate reply proposed a population, exposure, comparator and developmental outcomes, then quoted $1,900 for the full review. 404 Media considered the phone, email and chat interactions AI-generated. The reporting did not establish who operates Research Gold, how many customers it has, or whether completed research was produced using AI.
OpenAI Begins Testing Ads in ChatGPT OpenAI is testing clearly labeled ads in ChatGPT to help support free access. The company says ads will not influence answers and that the test includes privacy protections and user controls. openai.com
ChatGPT and Gemini Each Pass One Billion Users Google says Gemini has reached one billion monthly users, while an OpenAI spokesperson says ChatGPT surpassed one billion weekly users in July. The differing measurement periods prevent a direct comparison between the services. theverge.com
Two-Month-Old River AI Raises $1.1 Billion River AI, founded by former xAI co-founder Igor Babuschkin, raised $1.1 billion in a seed and Series A round led by General Catalyst and AI investment firm AMP PBC. Its API lets developers fine-tune and serve open models using reinforcement learning and LoRA. techcrunch.com
OpenAI Releases a ChatGPT Desktop App for Linux OpenAI launched a worldwide preview of its Linux desktop app, bringing ChatGPT, ChatGPT Work, and Codex to supported versions of Ubuntu, Debian, and Fedora. The company says compatible downstream distributions may also run the app. techcrunch.com
Nvidia Launches Nemotron 3.5 Lightning and an Open Model Router Nvidia released Nemotron 3.5 Lightning, a customizable 30-billion-parameter mixture-of-experts model for agent workloads, alongside the open-source NeMo Switchyard routing library. Nvidia claims Lightning can produce output up to four times faster than comparable models, while Switchyard directs requests among models according to quality, latency, and cost requirements. blogs.nvidia.com
OpenAI Reportedly Completes $7 Billion Employee Share Sale OpenAI reportedly bought $7 billion in shares from employees through a tender offer that valued the private company at $852 billion. OpenAI did not comment on the reported transaction. techcrunch.com
Google Tests AMIE in Simulated Video Consultations Google Research and Google DeepMind tested AMIE, a Gemini-based research medical system, in simulated video consultations with patient actors. Clinical evaluators rated it favorably across several competencies, but Google says more research is required before real-world deployment. blog.google
OpenAI Brings Daybreak Cybersecurity Models to AWS OpenAI and AWS made Daybreak cybersecurity capabilities available through Amazon Bedrock for enterprise security workflows. openai.com
Apple Tests iPhone Photo-Provenance System Code found in an iOS 27 beta reportedly describes an optional “Apple Reference Image” feature that embeds provenance data when an iPhone photo is captured. The unreleased system would send the raw image and metadata to Apple’s Private Cloud Compute infrastructure for authentication when requested by the user. theverge.com
Spotify Will Label AI Personas and Remove Them From Recommendations Spotify plans to begin marking profiles that represent AI-generated identities with “AI Persona” badges in September. Labeled profiles will be excluded by default from editorial, algorithmic, and personalized recommendations unless a user follows them. techcrunch.com
Zoom Patches Cross-Platform Device-Takeover Flaw Zoom patched a vulnerability in its annotation feature that researchers at A Security say could let an attacker execute code on meeting participants’ devices without user action or a visible warning. The researchers said they developed the exploit in one day using fewer than 20 prompts to publicly available AI models. theverge.com