Digital Colliers Daily Briefing — August 12, 2026
Three stories dominate today's agenda, and each touches a different pressure point in the frontier AI stack. Researchers published a cross-lab attack that decodes the encrypted chain-of-thought traces returned by OpenAI, Anthropic, and Google APIs — with recovered secrets to prove it. Google confirmed that its Gemini app crossed one billion monthly active users, closing the consumer gap with ChatGPT. And Anthropic became the first major frontier lab to commit to text-level watermarking of model output under the EU AI Act's Transparency Code. Together they sketch a market in which capability leadership, distribution scale, and regulatory compliance are all being contested on the same day.
1. Cross-lab attack decodes "encrypted" chain-of-thought from Claude, GPT, and Gemini
What happened. A team from the University of Tübingen, the Max Planck Institute, MATS Research, and Snyk published a paper — hosted at the vanity domain stolen-thoughts.com — demonstrating that the encrypted reasoning blocks returned by OpenAI, Anthropic, and Google APIs can be replayed into weaker sibling models from the same family, which can then be jailbroken into transcribing the hidden trace in plaintext. The attack exploits the fact that models within a family share a decryption key while smaller variants receive less alignment training. Against Claude, the researchers replayed signed thinking blocks into Haiku 4.5 with an assistant-turn prefill of <thinking-copy>; against GPT they injected encrypted_content items into fabricated conversations and sampled up to 50 outputs; against Gemini they attached thought_signature to a model turn with a <thought> prefill.
Applying the pipeline to 6,708 publicly shared agent trajectories from GitHub and Hugging Face, the authors reconstructed 315,320 reasoning blocks and recovered 704 distinct privacy artifacts — including 62 API keys, 33 passwords, 24 access tokens, and 30 email addresses. Sixty-four of those artifacts appeared only inside the hidden reasoning and nowhere in the visible session. The researchers also showed that seeding Kimi K3 with the first 1% of an Opus 4.8 trace nudged its answers toward Opus's wording, offering suggestive but non-causal evidence for distillation.
Why it matters. Hidden chain-of-thought has been the industry's answer to two problems at once: protecting IP from distillation, and offloading stateful inference cheaply via signed blobs the client stores. This paper punctures both premises. As Simon Willison noted, "every model under the same family used the same encryption key" — meaning the confidentiality guarantee was really a same-family authentication scheme, not a barrier against a determined replay attack. Latent Space framed the encryption as closer to "a stateless distributed-inference protocol optimization than a hard confidentiality barrier."
Who is affected. OpenAI, Anthropic, and Google have all acknowledged the disclosure and shipped short-term mitigations; Anthropic's Michael Aciman told Wired the company is "building short-term mitigations for the replay behaviors described in the report." Any developer who has ever shared a Claude Code or Codex session publicly with encrypted reasoning blobs attached should treat those artifacts as compromised. Enterprises relying on hidden CoT as a safety monitoring interface — the paper documents summarizers that hide the true answer, plus reasoning that plans website attacks or data exfiltration — should not.
What to watch next. Panfilov told Wired that fully closing the distillation vector would require "a fundamental overhaul to the way these companies' APIs work." Expect near-term API changes that break replay across sessions and users, and slower structural changes to how reasoning is signed, stored, and billed. The distillation angle will also feed into an already active policy debate: Meta's Mark Zuckerberg argued this week that distillation is core to open-source AI, while China hawks in Washington see it as a leakage vector to be closed.
Sources:
- [HN · 613↑] Stealing Reasoning Traces from Proprietary LLM APIs — Hacker News
- A New Trick Reveals AI Models' Inner Thoughts — Wired
- Stealing Reasoning Traces from Proprietary LLM APIs — Simon Willison
- [AINews] How to steal a Reasoning Trace — Latent Space
- Researchers find that feeding a frontier model's encrypted reasoning traces to a weaker model from the same provider can make it output the traces in plaintext (Will Knight/Wired) — Techmeme
2. Gemini app crosses one billion monthly users, closing the consumer gap with ChatGPT
What happened. Sundar Pichai announced via X that the Gemini app has reached one billion monthly active users, making it Google's 14th product to hit that mark and, by the company's own account, its fastest to get there. The figure counts only users who opened the Gemini app or web interface directly — it excludes Gemini's embedded footprint in Search AI Mode, Gmail, Drive, and Workspace, which Google separately says has crossed a billion monthly users of its own. The announcement follows Q2 2026 earnings, at which Google reported 950 million monthly users and daily actives tripling year over year.
Google also disclosed usage detail: 63% of Gemini users engage the assistant via voice, the app generates more than 150 million images per day, and iOS installs have topped 100 million active users. The company paired the numbers with the rollout of Gemini 3.5 Flash, positioned for coding and agent workloads.
Why it matters. ChatGPT reached the one-billion-user threshold in June, though OpenAI did not confirm it until an August 6 blog post. As The Verge observed, OpenAI "buried the announcement" in otherwise routine copy. Google's disclosure closes that gap in weeks, not quarters, and confirms a genuine two-horse race at the consumer tier — a scenario that looked far from certain a year ago when Gemini was being written off online. For advertisers, device OEMs, and enterprise buyers benchmarking assistant reach, the market now has two comparable general-purpose defaults rather than one dominant incumbent.
Who is affected. The clearest pressure is on the next tier — Meta AI, Microsoft Copilot, Perplexity, xAI's Grok — which now face two rivals with billion-user distribution rather than one. For OpenAI, the milestone removes the narrative of uncontested consumer leadership and sharpens the case for Sora, agent products, and paid tiers as differentiators. For Google, it validates the strategy of shipping Gemini into every surface it controls.
What to watch next. The Made by Google hardware event is imminent, and Gemini-powered Pixel features are the expected centerpiece. Beyond that, watch the ratio of daily to monthly actives — a metric on which ChatGPT has historically led — and the paid conversion figures, which neither company has disclosed at scale.
Sources:
3. Anthropic commits to text and image watermarks under the EU AI Act
What happened. Anthropic said on an updated Claude support page that all Claude models released after August 2 will automatically watermark generated text and files, and that support will be extended to older models. Text watermarks are embedded in the output itself and, per Anthropic, "will travel with the text when it's copied and pasted elsewhere, and may persist through some editing." Generated files will carry digitally signed provenance metadata using the C2PA standard. Watermarking is applied at the model level, so it covers every surface — Claude platform API, Claude, Claude Code, Claude Cowork, and Claude Tag.
The move is a direct response to the EU AI Act's Transparency Code, which took effect August 2 and requires AI-generated or edited content to be machine-detectable. According to TechCrunch, Black Forest Labs, Google, Meta, Microsoft, OpenAI, and Synthesia have also committed to the code; Anthropic is the first frontier lab to publicly specify text-level watermarking as its compliance mechanism.
Why it matters. Image watermarking via C2PA is now industry practice, but text watermarking has been treated as unsolved — with legitimate concerns about robustness, output quality, and the entropy cost on short generations like code. Anthropic's commitment forces the question into the open. Competitors that have signed the same code will need to demonstrate comparable mechanisms, and platforms downstream — publishers, code hosts, education providers — gain, at least in theory, a detection signal they did not have before.
Who is affected. Every Claude API customer whose output flows into user-facing products inherits the watermark. That is consequential for developer tools built on Claude Code, for enterprise document workflows, and for any application where indistinguishability from human output is a product requirement. It is also consequential for the emerging market in AI-content detection: as The Verge notes, watermarks are invisible to humans but designed to be machine-readable, which favors detector vendors partnered with model providers.
What to watch next. Two open questions. First, how much editing removes the mark — Anthropic did not specify, and adversarial robustness will determine whether the signal is useful for enforcement or merely for compliance theater. Second, whether OpenAI and Google follow with equivalent text-level commitments, or hold to file-level C2PA provenance and argue that text watermarking is technically premature.
Sources:
- Anthropic says it will watermark text generated by its AI models — TechCrunch AI
- Claude will apply invisible watermarks to AI text and images — The Verge AI
Taken together, the day's stories describe an industry being pulled in three directions at once. The reasoning-trace paper shows that the labs' technical moats — hidden CoT, cryptographic signatures, family-shared keys — are more porous than advertised, with immediate consequences for both IP protection and user privacy. Gemini's billion-user milestone confirms that consumer distribution is now a duopoly, not a monopoly, which raises the stakes for every product decision the two leaders make. And Anthropic's watermarking commitment marks the point at which EU regulation begins reshaping model output itself, not just its labeling. Provenance, provenance leakage, and market position are converging into one story.