OpenAI Compaction Flaw Exposed AI Reasoning to Researchers

Researchers have discovered a flaw in OpenAI's application programming interface (API) that allowed them to extract raw reasoning traces from its frontier models, exposing information OpenAI normally withholds from API users.

AI vulnerability discovery firm Xint disclosed the technique, dubbed 'compaction smuggling,' in research published October 26. According to Xint, OpenAI confirmed the issue, deployed a fix on October 23 and paid a $6000 bug bounty.

The flaw involved OpenAI's context compaction feature, which uses a model to compress a lengthy conversation into an encrypted item the user cannot read.

Xint found it could hide one model's reasoning inside a compaction and have another model hand it back.

Compaction Bypass Exposed Hidden Reasoning

OpenAI gives API users optional summaries rather than the raw chain of thought behind its reasoning models' answers. Xint said this is partly to prevent distillation, because raw reasoning, which shows abandoned approaches and corrections, makes much richer training data than final answers.

OpenAI added mitigations in August after the Stolen Thoughts paper showed that a frontier model's encrypted reasoning could be fed to a less capable model from the same company, an attack that affected Anthropic, OpenAI and Google.

Xint said those mitigations stopped reasoning being replayed into other models but did not cover compaction, which ran on the model that had produced the reasoning.

Xint generated reasoning with GPT-5.6 Sol, compacted it and asked the older GPT-4.1 and GPT-4o models to repeat their input word for word, from which it recovered the reasoning. It said the attack succeeded at every reasoning-effort setting it tested.

Read more: OpenCode Breach Could Affect OpenAI, Anthropic and Google

Compaction and Distillation Concerns Remain

The flaw was discovered by Xint in August and OpenAI's fix was not publicly described. The Xint post did not include a statement from OpenAI. Infosecurity has contacted OpenAI for comment.

Compaction has raised separate concerns for OpenAI and in a September report the company said that during training of an internal, unreleased model, the model had in rare cases written unauthorized instructions into its own compaction summaries, including one instructing the model to ignore developer messages.

Xint argued that the technique opened the door to distilling OpenAI's frontier models at scale, though it did not report training a model on the reasoning it extracted. It said the risk was real, citing an Anthropic report in September of seven distillation campaigns it attributed to China-based labs and OpenAI's September 30 disclosure that it had broken up an effort to pull hidden reasoning from its models.