FeedMeld

You know how ChatGPT, Claude, and Gemini all got 'extended thinking' modes that they promised were locked down and encrypted? Turns out those encrypted reasoning blocks were about as locked down as a diary with 'DO NOT READ' written on the cover. Researchers from the ELLIS Institute and Max Planck Institute published a paper this Tuesday showing that a trivially simple cross-model replay attack — feeding one company's encrypted reasoning tokens through a weaker sibling model in the same stack — spits out the full plaintext reasoning in plain text. No cryptography was actually broken. The 'encryption' was just a way to pass state between sessions, not a security boundary.

The scale of what they found is the part that should make every developer's stomach drop. The team scanned public repositories — GitHub, Hugging Face, places developers casually dump session logs — and found 315,320 exploitable reasoning blocks already sitting there. From those, they recovered 367 pieces of personally identifiable information and 182 credentials, including 62 live API keys and 33 active passwords. The paper notes that some of the reasoning contained fragments wild enough to name-check: one block contained someone's chicken marinade recipe alongside what appeared to be a plaintext database connection string. Security researchers have a term for this kind of finding. They call it 'not great.'

The timeline here is what makes this worse. Two independent researchers flagged the cross-session replay flaw to OpenAI and Anthropic through official bug bounty programs in May and June 2026. Both companies dismissed the reports. The formal paper submitted August 10 arrived eleven weeks later, forced the companies' hands, and all three providers appear to have patched the immediate vector — but the 315,000 blocks that were already in the wild aren't going anywhere. Security communities on Telegram had the paper circulating hours before mainstream tech outlets even had headlines. The AI industry built secret thought boxes and then shipped them to GitHub in public luggage.

For regular users the practical risk is low unless you've been pasting session logs anywhere public — which apparently many developers have been doing without knowing the encrypted blocks carried recoverable state. The bigger fallout is reputational: these companies sold 'hidden reasoning' as a moat, a way to protect their model IP from competitors. The paper's authors note that the attack could also be used to lift a strong model's reasoning patterns using a weaker, cheaper sibling. The AI industry's most expensive secret wasn't a secret at all.

“Researchers cracked the encrypted 'thinking' of GPT, Claude, and Gemini via a cross-model replay attack, recovering 315K reasoning blocks from public repos — including 182 live credentials. The bug was reported and dismissed by bug bounties months ago.”

Why It Matters

On August 10, Twitch pushed update v30.7 to its app. Buried inside was a new privacy setting — already toggled on — that authorizes Amazon to use any video broadcast on the platform to train its generative AI models. Not opt-in. Opt-out. You had to find the setting and turn it off, and most creators had no idea it existed until a handful of eagle-eyed users spotted the toggle and started screaming about it on X by Tuesday morning.

The backlash was swift, concentrated, and predictably furious. Prominent streamers began publicly opting out and walking their audiences through how to do the same.…

The post-election Bluesky boom of late 2024 is starting to feel like a very specific moment in internet history that has now fully passed. A TechCrunch report published today using Similarweb data shows Bluesky's monthly active users down 27.2% year-over-year as of June, with daily actives down 25.6% in July to around 3 million people. At its peak the platform had around double that. To be clear: these are not catastrophic numbers and the platform is not dying, but it is shrinking while its main competitors grow, and that's a different kind of problem.

The official Bluesky response to this…

It's August 11, which means GTA 6 is exactly 100 days away from its November 19 release date — and the internet is already in full pre-launch meltdown. The latest front: a growing wave of TikTok videos featuring women declaring, with varying levels of seriousness, that their significant others will not be allowed to play Grand Theft Auto 6 upon release. The videos range from clearly joking to genuinely confrontational, and the comment sections are some of the most chaotic real estate on TikTok right now.

Gaming Twitter and Reddit have been going back and forth about this trend all day, which…

Discord's August 11, 2026 changelog is doing something unusual in the current media landscape: it is being received well. The headline feature is private profiles — users can now restrict who sees their full profile bio, choosing between everyone, just friends, or only people in mutual servers. For a platform where server participation often means your bio is visible to thousands of strangers, this is a feature the community has been requesting for years.

Alongside the privacy controls, Discord shipped a full WYSIWYG editor for desktop bios — meaning you can now format your bio with a visual…