Encrypted reasoning blobs in shared AI conversations can expose secrets that sanitization never touches

Ilia Shumailov, a researcher working on AI security, has identified a category of secret-leakage that standard hygiene practices miss entirely. When a developer sanitizes a shared AI conversation, removing API keys and passwords from the visible output, the encrypted reasoning blobs attached to that conversation may still hold the originals. Those blobs are decodable. Posting the conversation to a public repository is enough to expose what was scrubbed.

The mechanism Shumailov describes is straightforward and its consequences are not minor. Visible output sanitization is the step most developers and automated secret-scanning tools focus on. The reasoning blob sits alongside that output, not inside it, and carries its own encoded record of what the model processed. A scrubbed conversation thread that looks clean at the surface level may be leaking credentials in a layer that most reviewers never inspect.

Shumailov puts the point directly: “Even if you like did some sanitization on like visible part you just removed all API keys like all passwords, but you like the encrypted blobs are still there. I can like download it from the GitHub and I can decode them and I can see like what the password that what model was thinking about.”

Even if you like did some sanitization on like visible part you just removed all API keys like all passwords, but you like the encrypted blobs are still there. I can like download it from the GitHub and I can decode them and I can see like what the password that what model was thinking about. Ilia Shumailov

That claim has since been confirmed at scale. Researchers at Profero, writing in a report titled “Stolen Thoughts” published in August 2026, analyzed 6,708 public agent trajectories committed to GitHub and extracted 704 privacy artifacts from the reasoning blobs embedded in them. Among those artifacts: 62 API keys and 33 passwords, retrieved from conversations whose visible portions gave no indication anything sensitive remained. The finding was independently corroborated by several security researchers, including Samir Sengupta, Scott Armbruster, and teams at CopperRiver and SourceFeed.

The numbers matter because they push the problem out of the theoretical. This is not a hypothetical attack path that requires unusual access or sophisticated tooling. It requires pulling a public repository and running a decoder. The 6,708 trajectories Profero examined are the kind of agentic workflow logs that developers routinely share for debugging, demonstration, or collaboration, and the 704 artifacts extracted from them represent a consistent yield rate, not a handful of edge cases.

What the Profero finding adds to Shumailov’s original observation is a sense of how widely the gap between perceived and actual sanitization has already played out in the wild. Developers who believed they had cleaned their logs before publishing them had not. The secrets were present in a layer they did not know to check, in a format that is technically encoded but not protected against a motivated reader.

The practical implication is that any workflow treating reasoning blobs as safe to share after visible-output scrubbing needs to be reconsidered. Secret-scanning tools built around pattern-matching on plaintext output will not catch material that sits in an encoded blob one layer removed. Until tooling catches up to the architecture, the only reliable mitigation is not sharing reasoning traces that ever touched sensitive inputs, regardless of what the visible output looks like after the fact.