The Intake — Friday, August 14, 2026

If you've been using reasoning-capable models from Anthropic, OpenAI, or Google, the encrypted thinking blocks returned alongside API responses weren't as private as the encryption implied. Researchers from the ELLIS Institute Tübingen and Max Planck Institute published their findings on August 10. The paper is arXiv 2608.09867. They discovered a single global decryption key embedded across all three providers' APIs.

The researchers scanned 6,708 publicly available agent session logs. Using the shared key, they decoded reasoning content from those logs. From those decoded traces, they recovered credentials and PII from genuine user sessions. All three vendors have since applied mitigations.

If your agent published session logs before the mitigations shipped, check whether those logs include reasoning blocks from any of these three APIs. That content is potentially decodable. The exposure window is retroactive to logs published before the fixes went live.

If you're running LiteLLM in a CI/CD pipeline, the affected versions are 1.82.7 and 1.82.8 on PyPI. Trivy is an open-source vulnerability scanner widely used in CI/CD pipelines. TeamPCP compromised it in March 2026. They used that access to poison LiteLLM on PyPI.

The stolen credential archive surfaced publicly this week. It is 153 GB. It covers 2,488 organizations and approximately 434,000 CI/CD pipelines. Contents include AWS keys, Salesforce secrets, Slack tokens, Azure environment variables, AI provider API keys, and database passwords. Organizations named in coverage include AWS, Samsung, Cisco, NVIDIA, Microsoft, and FedEx. The FBI issued FLASH-20260702-01 in July. The advisory warns that harvested credentials from this breach will be used in follow-on attacks.

If you installed LiteLLM 1.82.7 or 1.82.8, those are the compromised versions. The credential archive is already public.

Paperclip AI is an AI agent tool. Oasis Security published the disclosure on August 5. Three vulnerabilities are in scope; the most severe is unauthenticated remote code execution (CVE-2026-41679, CVSS 10.0 — the maximum score).

Two additional vulnerabilities in the same disclosure carry critical ratings — CVSS 9.6 (GHSA-x8hx-rhr2-9rf7) and CVSS 8.3 (GHSA-xfqj-r5qw-8g4j). The Oasis Security blog post names the affected components for each.

If you're running Paperclip AI in any network-accessible environment, CVE-2026-41679 is the priority exposure. No credentials are required to reach it.

---