OpenAI patches compaction flaw that exposed hidden model reasoning

Security firm Xint demonstrated a method to extract hidden reasoning from OpenAI’s gpt-5.6-sol model by exploiting the platform’s conversation compaction feature. The technique bypassed protections implemented in August, allowing researchers to view encrypted internal thought processes as plain text. OpenAI confirmed the vulnerability and deployed a fix on October 23.

What happened

OpenAI’s reasoning models generate a detailed chain of thought before producing a final answer. To protect intellectual property and prevent distillation, the service returns this raw reasoning as an encrypted object that users cannot read directly. However, Xint researchers showed that the compaction feature, designed to shrink long conversations for efficiency, could be manipulated to output this hidden data in readable format. The method successfully extracted reasoning from math and algorithm puzzles created by the researchers themselves.

The extraction process did not involve accessing other users' data, and Xint did not claim the ability to steal reasoning from unrelated sessions. While the extracted text matched the input requests, Xint noted it could not verify if the output was word-for-word identical to the original internal reasoning, as they never had access to the unencrypted source. The possibility remains that the compaction process may have reworded the content slightly during extraction.

This vulnerability circumvented a previous security update. In August, a paper titled "Stolen Thoughts" revealed that encrypted reasoning from a powerful model could be replayed into a weaker model from the same provider, which would then output the text in plain language. OpenAI blocked this cross-model replay attack shortly after its discovery. Xint’s new method avoided this block because the compaction step occurs within the same model that generated the reasoning, thereby not triggering the cross-model security checks.

How it works

Compaction is an OpenAI feature that uses a model to compress a long conversation history into a smaller, encrypted item that preserves context for future turns. Xint leveraged this mechanism by sending a task to gpt-5.6-sol and retaining the resulting encrypted reasoning. They then invoked the compaction step on the same model, instructing it to copy the reasoning into the compacted item verbatim. To evade usage-policy filters, the researchers replaced every space in the text with a tab character.

Once the reasoning was embedded in the compacted item, Xint passed it to cheaper models, specifically gpt-4.1 and gpt-4o. These models were asked to repeat their input exactly. Both models complied, outputting the hidden reasoning as plain text. This approach built on Xint’s earlier research, known as GhostCompact, which demonstrated that the compaction step could be coerced into executing tasks chosen by an attacker rather than just summarizing context.

Key details

• The vulnerability affected gpt-5.6-sol, one of OpenAI’s reasoning models, but GPT-6 Astra was not tested.
• OpenAI deployed an undisclosed fix for the issue on October 23, 2026.
• Xint received a $6,000 bug bounty reward from OpenAI for reporting the flaw.
• The method bypassed August protections by keeping the compaction process within the same model instance.
• Researchers replaced spaces with tabs in the payload to circumvent usage-policy filters.
• Xint has published the demonstration code in its GitHub repository.

Why it matters

For developers building applications on top of large language models, this incident highlights the complexity of securing server-side inference pipelines. While this specific fix was handled entirely by OpenAI and required no changes from API users, it underscores that hidden reasoning is a high-value target. Competitors seek these internal thought processes because they provide superior training data for distillation compared to final answers alone. Understanding how models work through problems allows rivals to train cheaper, more efficient models that mimic the reasoning capabilities of larger systems.

The broader implication is that any server-side operation that decrypts and processes hidden reasoning carries inherent leakage risks. Xint argues that patching this single vector may not be sufficient, as any step that reads decrypted reasoning and follows user instructions could potentially be exploited. This aligns with recent reports from Anthropic and U.S. government advisories regarding China-based labs targeting the hidden reasoning of American AI models. Although this specific demonstration was not linked to those state-sponsored efforts, it validates the technical feasibility of such attacks.

What you can do

• Monitor OpenAI’s release notes for updates regarding reasoning model security and compaction features.
• Review your application’s dependency on hidden reasoning outputs if you are using older API versions.
• Assume that any server-side processing of encrypted model internals may have potential side-channel risks.
• Stay informed about distillation threats and consider how your own model outputs might be used for training competitors.
• Follow security research from firms like Xint to understand emerging vectors in LLM infrastructure.
• Ensure your usage policies account for novel evasion techniques, such as character substitution in prompts.