Encrypted CoT Vulnerability Leaks API Keys; NVIDIA Launches Nemotron 3.5 Lightning

Latent Space · rss · 2026-08-12

Encrypted Chain-of-Thought (CoT) Extraction Vulnerability

A significant paper reveals a severe security flaw in the APIs of frontier models (like Claude, GPT, Gemini) that hide and encrypt their reasoning processes. Researchers demonstrated that by replaying encrypted reasoning blocks into weaker models from the same provider and using prompt prefills, the hidden CoT can be decoded and extracted.

Privacy Risks: Scanning 7,000 public Claude Code/Codex traces, researchers found 62 unique API keys, 33 email addresses, and 33 passwords leaked within the decoded reasoning blobs.
Safety & Monitoring Debate: The vulnerability raises privacy concerns about sharing API sessions publicly and proves that hidden CoT is not a reliable monitoring interface. Experts note this is more of an inference protocol optimization than strict confidentiality, urging labs to strengthen sandboxing and tool surface security.

NVIDIA Releases Nemotron 3.5 Lightning

NVIDIA launched Nemotron 3.5 Lightning, a 30B MoE model (3.6B active params) designed for always-on agent workloads. It supports a 1M context, delivers up to 4x throughput, and shows strong agentic benchmark performance. Now available across multiple platforms, it highlights the industry trend towards smaller, faster open models tuned for high-volume tool use.

Unsloth Desktop Launches

Unsloth introduced an open-source desktop app for running and training models locally across Mac, Windows, and Linux. It integrates tool calling, sandboxed code execution, RAG, and MCP, aiming to be a comprehensive local AI operating environment rather than just a chat UI.

Original post →

Encrypted CoT Vulnerability Leaks API Keys; NVIDIA Launches Nemotron 3.5 Lightning

More from Models