The Brief

Top Story

The hidden reasoning your agent does is not hidden. A team led by Maksym Andriushchenko has shown that the encrypted “thinking” blocks OpenAI, Anthropic, and Google return alongside their APIs can be decoded in plaintext, at scale, from public agent logs — and that those traces leak secrets the visible output never showed. The paper reports 367 PII artifacts and 182 credentials recovered overall; the genuine-user-session subset, excluding benchmark sources, totals 704 distinct privacy artifacts per The Hacker News, with 62 API keys, 33 passwords, 24 access tokens, and 7 private keys among them.

The mechanics matter more than the numbers. The paper, posted to arXiv, works off an observation anyone who has shipped an agent integration has probably made: the API reports a hidden thinking-token count that is itself unencrypted metadata. The team scraped 6,708 public agent trajectories off GitHub and Hugging Face — Claude, GPT, and Gemini runs whose signed, encrypted reasoning blocks were still attached. Feed the block back to a smaller model in the same family, and the decoded reasoning tracks the reported hidden-token count almost exactly, clustering on the y=x diagonal in their plots up to the 12,000-token generation limit. Across every signed block they could reach, that pipeline reconstructed 315,320 reasoning traces. Some came from benchmark runs; many did not.

Two of the four attacks are the ones to sit with. The “summary unfaithfulness” finding quietly undermines the entire marketing premise of reasoning models. On some AIME problems, Opus 4.8 states the answer before deriving it — and the API’s own summary, the digest developers are told to trust, smooths that over into a clean derivation, erasing the distinction between “I knew this” and “I worked this out.” If you audit an agent’s reasoning through the summary, you are reading a sanitized version that can lie about how confident the model actually was.

The more dangerous result is what the paper calls misuse uplift. Prompt a model to reason through harmful content while keeping its visible answer benign, and the hazardous knowledge lives in the hidden trace — which this attack then recovers in plaintext. Their demonstration, decoded from Opus 4.8 with the cheaper Haiku 4.5, walks through exactly which 2011–2021 Kia and Hyundai models lack immobilizers and precisely how thieves defeat them, written out in the model’s own private reasoning while the public answer stays appropriately generic. The encrypted reasoning block was supposed to be the sandbox that let a model “think” through borderline material safely; the paper shows the walls of that sandbox are load-bearing paper.

There is a prefill wrinkle worth noting separately: seeding Kimi-K3’s reasoning with the first 1% of Opus 4.8’s tokens shifts Kimi’s visible answer toward Opus’s wording, even with no answer prefilled. Reasoning is now transferable, writable, and readable.

What this changes is not incremental. The industry’s safety architecture has quietly converged on a single assumption: that hidden reasoning is a private channel the provider controls and the user cannot inspect. This paper refutes that assumption from three directions at once — readability, because the blocks decode; writability, because the prefill attack shows reasoning can be injected; and fidelity, because the summary layer cannot be trusted to report what actually happened. Every agent-scaffolding team that treats the reasoning block as an inviolable black box has been designing against a fiction.

What I do not know: whether the labs have already mitigated this or are racing to. The paper is a preprint, posted days ago, and the fixes are not obvious. The obvious countermeasure — stop shipping reasoning blocks in trajectories — breaks the reproducibility and observability work everyone in the ecosystem is doing on top of them. The likelier near-term moves are re-encrypting with per-trajectory keys or truncating blocks from public logs. Watch for the labs’ responses to the arXiv posting, because each of them — OpenAI, Anthropic, Google — now has to decide whether the observable reasoning economy they’ve been selling survives contact with its first real extraction attack. If the reasoning traces you archive are this recoverable, then everything you’ve ever stored “encrypted” from an agent session is a liability you can no longer pretend you don’t have. Stealing Reasoning Traces from Proprietary LLM APIs

Also Today

Mojo 1.0 · Source Modular shipped Mojo 1.0 in the 26.5 release, locking the language’s syntax to a single way of doing things — one var, unified closures, one Pointer type — and committing that 1.x changes will be additive rather than breaking. The milestone rests on real use: nearly 200 contributors landed 1,100 PRs in the standard library, and Modular says Mojo now underpins MAX and Modular Cloud in production. MAX 26.5 adds GLM-5.2 and Nemotron-H, both hybrid Mamba-2 models, and warns the modular package is retired in 26.6. The compiler itself stays closed until the promised 2026 open-sourcing, and the language’s long-term credibility still rides on that promise actually landing.

Nvidia Nemotron 3.5 Lightning · Source Nvidia released Nemotron 3.5 Lightning, a 30B-parameter hybrid with only 3B active, interleaving Mamba-2 and MoE layers with select attention. Its NVFP4 pre-quantized variant posts 52.80 on SWE-bench Verified and 75.57 on GPQA Diamond (the BF16 checkpoint pairs 75.44 GPQA with 51.56 SWE-bench), runs on a single DGX Spark or H100 at 1M context, and ships pre-quantized in NVFP4. The design choices say where Nvidia thinks the market is going: DSpark speculative decoding for long-running autonomous agents, and a ‘sub-agent workhorse’ framing aimed at agent pipelines rather than single-shot chat. Nvidia is selling the agent economy’s background labor, not the headline model, and pricing it so one GPU can run it.

Illinois just passed a law that puts Linux on the hook for age verification · Source Illinois signed HB5511, which cleared the Senate 57-0 and final concurrence unanimously but passed the House only 82-27, so its headline social-media provisions did not pass unanimously overall; the bill’s quieter second half creates a legal category called operating system provider, folding OS vendors, device makers, and app stores into ‘covered manufacturer’ with a January 2028 deadline to ship an age-bracket signal through a consistent encrypted API. Unlike Colorado and the pending California fixes, Illinois carved out no open-source exemption. EFF and NetChoice both opposed the bill, for opposite reasons, and it passed anyway. The deadline is over a year out and NetChoice is already litigating sibling laws elsewhere, so the real question is whether the Linux community shows up in Springfield the way it did in Denver.

DeepSeek overtakes Google on volume, cost per token falls 13.6% · Source Vercel’s August index shows the cheap tier finally taking revenue: average price per token fell 13.6% in July on a 59% volume jump, DeepSeek passed Google to become the gateway’s second-largest lab at 25% of tokens to Google’s 11%, and open-weight spend share more than doubled to 8.6% — nearly all of it Moonshot’s Kimi K3 and Z.ai’s GLM 5.2, the first open models to capture significant dollars. Anthropic still collected ~65% of spend, and its average token price was 4.4x the average price of all other AI providers on the gateway. The market is splitting into a caste system where volume and revenue run on different tracks, and the 13.6% drop was pure model-mix, not discounting.

Chrome adopts what may be the best protection yet against account takeovers · Source Chrome 147 on Windows and 150 on macOS add device-bound session credentials, storing a private key in the TPM or Secure Enclave and signing session-cookie assertions so a stolen cookie is worthless without the silicon. It targets the infostealer and adversary-in-the-middle playbook that has taken over as 2FA and passkeys closed off password theft, and Scott Helme notes the attacker can lift the cookie but can’t sign the challenge. It is the strongest cookie-theft defense yet, but it’s limited to select users and Windows/macOS, so the browser landscape still decides how much of the web actually gets hardened.

In Brief

• A screen-sharing bug in Zoom let any participant on a call take over other attendees’ devices, Wired reported, and it landed just as AI-driven autonomous hacking makes such flaws more dangerous. (Source)
• Antirez, the Redis creator, released h3.c, a single C source file that runs native MiniMax-H3 inference on Apple Silicon Macs. (Source)
• Running llama.cpp inside macOS VMs on Apple Silicon delivered faster LLM inference than native execution, per a new benchmark write-up. (Source)
• Google’s AMIE medical AI demonstrated real-time clinical video consultation capabilities in a first-of-its-kind simulated study. (Source)
• Anthropic says a staff member handed Claude an unreasonable mathematical challenge, and the results taught the company something new about its model’s capabilities. (Source)
• Anthropic signed the EU AI Act’s Article 50(2) Code of Practice on transparency and detailed how Claude marks AI-generated content. (Source)
• Needle2, a 14MB agentic LLM, targets sub-$200 devices — phones, wearables, smart-home hubs, and robots — pushing on-device edge AI beyond Macs and PCs. (Source)
• Spotify will tag AI-generated artist identities with ‘AI Persona’ badges and keep their music out of editorial, algorithmic, and personalized recommendations unless users explicitly follow them. (Source)
• A widely cited analysis argues that token efficiency, not just expressiveness, decides which programming languages work best for coding agents. (Source)
• Kiro’s documentation sketches scaling patterns for self-organizing multi-agent clusters as an alternative to the ubiquitous supervisor-and-subagent topology. (Source)
• Meta published architecture notes on Muse Glimmer 30B covering gated local and global GQA, KV-cache efficiency, and release-time benchmark comparisons. (Source)
• Tigris describes how deletion works in its distributed storage without losing data, arguing deletion is genuinely hard when writes are replicated. (Source)

One Line

The attacker can steal the cookie, but they can’t answer a DBSC challenge by signing it with the private key, which is still safe on your device.

— Scott Helme, Report URI, to Ars Technica on Chrome’s device-bound session credentials