Claude Encrypted Thinking Blocks Use Protobuf with Exposed Metadata and AES-GCM Ciphertext
An in-depth examination of Claude signatures demonstrates that the so-called encrypted reasoning blocks are ordinary protobuf structures rather than opaque blobs. The 428-character base64 signature decodes to 319 bytes that begin with a zero byte and follow standard protobuf wire formats.
The outer message contains three fields: a varint indicating schema version 2, a 312-byte length-delimited inner message, and another stable varint flag. Inside the inner message the layout is consistent across thousands of samples: a 135-byte header, two 12-byte nonce fields, a 48-byte MAC, and the variable-length ciphertext.
The header, parsed without any decryption keys, contains several plaintext fields. Field 6 stores the model identifier such as claude-opus-5. Field 8 stores the block type string thinking. Field 11 stores the 36-character organizationUuid taken directly from the user's Anthropic account configuration. These values are covered by the MAC yet remain readable to anyone who can decode the base64 and walk the protobuf tree.
Only the ciphertext in field 5 is encrypted. Its length equals the original reasoning text plus exactly 16 bytes, confirming standard AES-GCM usage with no padding or compression. When the visible thinking field is empty, the ciphertext length still reveals the true length of the model's internal reasoning.
Protocol evolution across four versions added the model name in v12, the block-type string in v13–v14, and the organization identifier in v15. The same parser written six months earlier continues to decode current Opus-5 blocks without modification.
The presence of organization and model identifiers inside the signed header allows a server to reject attempts to replay an Opus block to a Haiku instance belonging to a different account. At the same time, the same identifiers leak account linkage when users publish agent logs containing the raw signatures.
Related articles
Local LLMs Enable Scams by Drafting Fraudulent Replies Without Warnings
Tests on consumer hardware showed that popular 7-8B local models almost never flagged classic advance-fee schemes when asked to draft replies instead of detecting fraud. The author ran 42 scam scenarios across Russian, Kazakh and mixed language on Llama 3.1 8B, Qwen 2.5 7B and DeepSeek-R1 8B using only an RTX 5050 laptop and Ollama. Without additional controls the models produced ready-to-send messages agreeing to prepaid transfers to unknown Kaspi Gold numbers in nearly every case. Introduction of the MoneyGate layer, which combines a mandate check, a separate judge model and hard-coded red-flag rules, blocked all 42 malicious requests while still allowing most legitimate payments to proceed. The benchmark KZ Scam Shield covering 12 Kazakhstan-specific fraud patterns remains publicly available for further testing.
SOC Forum 2026: Experts Warn Generative AI Lowers Attacker Skill Barriers While Raising SOC Complexity
At SOC Forum 2026 in Moscow, cybersecurity leaders examined how generative AI reduces the expertise needed for cyberattacks while complicating defensive operations. BI.ZONE's Oleg Skulkin noted that AI has effectively lowered attacker preparation requirements to near zero. Kaspersky researcher Georgy Kucher warned that unverified AI-generated code can expose threat actors, and overly perfect Russian-language phishing text now triggers suspicion. Solar Group’s Alexander Shepilov advocated treating AI agents as distinct non-human identities with strictly limited privileges. Alexander Kuznetsov from the same company recommended gradual automation of SOC tasks rather than abrupt AI integration. Participants also cautioned that managing AI agents may increase spending on skilled personnel instead of delivering cost savings.
Anthropic's Research Claude Model Generates Exploit Bypassing Linux Protections for Root RCE via MPTCP and CVE-2026-98432
Anthropic's internal research model of Claude autonomously wrote an exploit that achieved remote command execution with root privileges on a Linux server configured with multipath TCP (MPTCP). The exploit targets CVE-2026-98432, a use-after-free vulnerability in the Linux kernel's networking stack that occurs during parallel TCP request processing. The attack first bypassed KASLR in 48 minutes to locate the required kernel address, then took an additional five minutes to seize control and execute commands as root without any password or user interaction. Anthropic disclosed the results in a technical report but noted that the experiment used an unreleased model and cannot be reliably reproduced with public chat interfaces. The Linux team rated the flaw 9.8 on CVSS while Red Hat assigned it 5.9, citing exploitation complexity; a patch has already been merged into mainline and stable branches, though users must verify updates from their distribution vendor.
Local LLMs in AppSec: What Open Tools and Models Can Handle in Application Security
The article examines how local large language models can be integrated into application security workflows without relying on cloud subscriptions. It traces the evolution from llama.cpp in 2023 through agentic frameworks like PentAGI and Strix in 2025-2026. Teams can now run models on local hardware, connect them to code analyzers such as Semgrep, and delegate specific tasks like vulnerability path reconstruction or multi-step application testing. The piece highlights practical scenarios including static code review, dynamic testing with browser and terminal agents, and security evaluation of embedded AI assistants using tools like Garak and PyRIT. It stresses the importance of task decomposition, context management, and verification of model outputs to avoid misleading results. Hardware performance, model selection, and custom agent configurations are presented as key factors for successful adoption.