In the same week federal agencies began scoping migrations under the White House's new Post-Quantum Cryptography Executive Order, a group of academic researchers published a paper that, on its face, had nothing to do with quantum computing at all. It described a flaw in how three of the most security-conscious engineering organizations on earth, OpenAI, Anthropic, and Google, protected the hidden "reasoning" their AI models generate between steps of a task. The flaw was not that their encryption was weak. It was that their architecture assumed encryption alone was enough.
That distinction is worth examining, because it is the same distinction the new PQC mandate leaves largely unaddressed. A close look at what actually happened in the AI reasoning disclosure offers a preview of a gap that federal agencies, defense contractors, and anyone racing to hit a 2030 compliance deadline should think about now, rather than after the audits begin.
What Happened
Researchers from the ELLIS Institute Tübingen, the Max Planck Institute, and collaborating security teams found that OpenAI, Anthropic, and Google encrypted reasoning artifacts were not sufficiently bound to the user, session, model, or security context for which they were created.
The consequence was straightforward once identified. An encrypted reasoning block produced by a capable model could be handed to a weaker, less-guarded model in the same product family and decoded there. No cryptographic algorithm was broken and no key was cracked. The boundary that was supposed to keep one session's hidden reasoning separate from another's simply did not exist, because there was only ever one key protecting all of them.
The scale of what that made possible is the part worth noting. Working from public agent logs, the research team decoded more than 315,000 hidden reasoning blocks and recovered 182 real credentials, including live API keys, passwords, and access tokens, all sitting inside logs that were assumed to be safe precisely because the reasoning inside them was encrypted.
All three vendors moved quickly once notified. Server-side patches closed the specific replay path the researchers demonstrated, and vendor guidance has since changed. But the fix only runs forward. The transcripts already decoded and already public remain decoded and public. A patch can stop a mechanism from being exploited again. It cannot retroactively re-seal what a single point of failure already let out.
The Takeaway
It is tempting to read this as a story about AI companies specifically. But it is more useful to look at this as a story about a pattern that shows up anywhere "encrypted" quietly gets treated as a synonym for "compartmentalized."
Encryption answers one question: can this data be read without the key. It does not answer a second, equally important question: if the key, or the system holding it, is ever compromised, how far does that compromise travel. Those are different risk dimensions. The first is a cryptography problem. The second is an architecture problem, and it is decided by choices that sit downstream of whichever algorithm is running underneath, such as whether a system uses one key or many, one channel or several, one point of trust or a distributed set of them.
A single global key is not a weak algorithm. It is a centralization decision, and centralization decisions are exactly the kind of choice that a purely algorithmic compliance standard has no vocabulary to evaluate.
The New PQC Executive Order Has the Same Blind Spot
The Executive Order issued on June 22, 2026, requires High Value Assets, National Security Systems, and covered Defense Industrial Base contractors to transition to Post-Quantum Cryptography, as defined by NIST FIPS standards, by December 31, 2030. It is a necessary and overdue mandate. The threat it addresses, adversaries harvesting encrypted data today with the intent of decrypting it once sufficiently powerful quantum computers exist, is real and well documented.
But the order defines compliance almost entirely in algorithmic terms. It specifies which cryptographic primitives, including quantum-resistant key exchange methods such as ML-KEM, are approved, and it establishes that systems will be tested and audited against that standard. What it does not address is architecture, such as, how many independent channels carry a given data flow, whether the compromise of a single key or credential exposes one session or an entire system, and how the blast radius is contained independent of whichever algorithm sits underneath it.
The AI reasoning disclosure is a live, dated illustration of exactly that gap. The algorithm protecting those reasoning blocks was sound. The exposure was significant anyway, because architecture was never in scope of the design decision that mattered most. A compliance standard built the same way, one that certifies the lock without asking how many doors it is protecting or whether one key opens all of them, risks certifying systems that are compliant and still structurally fragile.
The Forward-Looking Point
None of this argues against the PQC mandate. Migrating to quantum-resistant algorithms is necessary work, and agencies and contractors should treat the 2030 deadline as the floor, not the finish line. The algorithm swap is a necessary condition for security in a post-quantum world. It has never been a sufficient one.
As agencies and Defense Industrial Base contractors plan their migrations, architectural questions deserve a parallel workstream rather than an afterthought once FIPS compliance is checked off. How many independent segments carry sensitive traffic? What a single compromised credential, key, or session actually exposes? Does the system's design assume a breach will be contained, or does it assume it will not happen?
The agencies writing today's audits are, understandably, asking whether the math is quantum-resistant. The more durable question, and the one the AI reasoning disclosure just answered for us in public, is whether compliant is going to end up meaning compartmentalized, or just meaning using the right math.
In a follow-on article, we will examine the AI-security side of this incident: why encrypted AI artifacts require contextual authorization, controlled communications, and protection of the paths through which AI systems interact.
The Question Worth Asking
Is your organization treating PQC migration as a compliance deadline or an architecture opportunity? We'd like to hear how you're thinking about it.
📞 Book a consultation with Dispersive Stealth Networking: www.dispersive.io
Header image courtesy of OpenClipart-Vectors from Pixabay.
