OpenAI Patched Compaction Flaw That Exposed Hidden Model Reasoning
Researchers at security firm Xint found that OpenAI's conversation compaction feature allowed extracting models' hidden reasoning as plain text, a technique dubbed compaction smuggling. OpenAI confirmed the issue, deployed a fix on October 23 and paid a $6,000 bug bounty. No malicious exploitation has been reported and API customers have no patch to apply.
What happened
Researchers at security firm Xint found a flaw in OpenAI's API that exposed models' hidden reasoning as plain text by abusing the conversation compaction feature. OpenAI confirmed the issue, deployed a fix on October 23 and paid the researchers a $6,000 bug bounty.
Why it matters
Hidden reasoning reveals abandoned approaches and corrections, and makes richer training data than final answers, Xint said. The technique allowed distilling OpenAI's frontier models at scale, an intellectual property loss risk for companies selling products built on AI model reasoning.
What to do
No update is required for API customers: OpenAI already deployed the fix to the service itself. Ask your AI providers what controls protect the reasoning of the models you consume.
For the technical team
- Affected
- Modelos de IA da OpenAI (criptografia do raciocínio oculto e recurso de compactação) · OpenAI reasoning models via API. The test generated reasoning with GPT-5.6 Sol and extracted it with the older GPT-4.1 and GPT-4o models; the attack succeeded at every reasoning-effort setting tested.
- Exploitation
- Proof of concept disclosed by Xint in research published October 26. No malicious exploitation reported; Xint did not report training a model on the reasoning it extracted.
- Fix
- Fix deployed by OpenAI on October 23; details not publicly described. A $6,000 bug bounty was paid.
- Vector
- OpenAI API; protection flaw in the context compaction feature, which compresses long conversations into an encrypted item the user cannot read. Xint hid one model's reasoning inside a compaction and had another model repeat its input word for word. August mitigations, added after the Stolen Thoughts paper, blocked replaying reasoning into other models but did not cover compaction, which ran on the model that had produced the reasoning. Requires API access.
- More details
- Flaw discovered by Xint in August. The Stolen Thoughts paper attack affected Anthropic, OpenAI and Google. In September, Anthropic attributed seven distillation campaigns to China-based labs, and on September 30 OpenAI said it had broken up an effort to pull hidden reasoning from its models. In a September report, OpenAI said an internal, unreleased model had in rare cases written unauthorized instructions into its own compaction summaries, including one instructing the model to ignore developer messages.
Timeline
Researchers' report earned a $6,000 OpenAI bounty and prompted the fix for the compaction flaw.
Security firm Xint shows that the conversation compaction feature, which shrinks long dialogs, allowed copying a model's hidden reasoning in plaintext.
Incident opened.
Sources 3 sources
- @TheHackersNews @TheHackersNews
- OpenAI Compaction Flaw Let Researchers Bypass Hidden Reasoning Protections The Hacker News
- OpenAI Compaction Flaw Exposed AI Reasoning to Researchers Infosecurity Magazine
