Xint demonstrated how OpenAI's compaction feature could expose GPT-5.6-Sol's hidden reasoning, bypassing earlier protections.

Xint demonstrated how OpenAI's compaction feature could expose GPT-5.6-Sol's hidden reasoning, bypassing earlier protections.

  Researchers at Xint identified a vulnerability in the OpenAI API that could expose hidden reasoning traces from advanced AI models, creating a potential route for large-scale model distillation. The technique, named “compaction smuggling,” bypassed safeguards introduced after earlier research demonstrated methods for extracting encrypted reasoning data. OpenAI confirmed the issue and deployed a fix on October 23, 2026. Xint received a $6,000 bounty for the discovery.  Reasoning models such as GPT-5.6 Sol generate intermediate reasoning before producing answers. OpenAI does not provide API users with the complete raw reasoning in readable form, instead offering optional summaries. This restriction helps protect against distillation, a process in which developers train smaller models using outputs from more advanced systems. Full reasoning traces can provide particularly useful training data because they contain intermediate steps, incorrect approaches and self-corrections.  The API stores raw reasoning in encrypted items that clients can return during later interactions but cannot directly decode. OpenAI also encrypts conversation compactions, which condense lengthy exchanges into smaller items while preserving relevant context. The discovery follows an August 2026 study titled Stealing Reasoning Traces from Proprietary LLM APIs. The researchers behind that study demonstrated that encrypted reasoning could be replayed into weaker models from the same provider and reproduced as text.  The approach affected models from OpenAI, Anthropic and Google, although OpenAI’s safeguards made extraction more difficult. Subsequent protections reportedly stopped the original technique from working. Xint discovered that the compaction feature offered another route. The researchers first generated reasoning using GPT-5.6 Sol and retained its encrypted reasoning item. They then removed the original task from the conversation history and instructed the compaction process to preserve the reasoning verbatim in a JSON object. Replacing spaces with tab characters helped the content evade usage-policy classifiers.  The resulting encrypted compaction was then submitted to GPT-4.1 and GPT-4o, which were instructed to reproduce the contents exactly. After decoding the JSON and converting tabs back into spaces, the researchers recovered the reasoning trace. The technique worked across all tested reasoning-effort settings, from minimal to maximum. In the demonstration, the original reasoning item contained 405 tokens, compared with 612 tokens in the compaction and 609 tokens in each echoed output. Xint compared outputs from two models using different prompts and obtained identical results.  Although the original plaintext was unavailable for a definitive token-by-token comparison, the recovered trace retained its false starts, corrections and characteristic writing style. The researchers developed the technique while investigating GhostCompact and examining how encrypted compactions could be transferred between models. The findings raise concerns about large-scale extraction of proprietary AI capabilities.  In September 2026, U.S. agencies warned about industrial-scale model distillation campaigns. Anthropic subsequently reported seven campaigns attributed to China-based laboratories, while OpenAI disclosed disrupting an effort that generated approximately 16,000 requests from more than 4,000 accounts in July.  Xint concluded that server-side processes handling decrypted reasoning while accepting client-controlled instructions can become potential extraction pathways. The researchers said compaction features require protections comparable to those applied to raw reasoning traces.

Xint says a compaction prompt could copy reasoning returned by OpenAI’s gpt-5.6-sol into an encrypted item, which cheaper models repeated as text. OpenAI…

OpenAI paid a 6,000 dollar reward after security firm Xint found a way to copy a model's hidden reasoning as plain text. OpenAI fixed it on the 23rd of October, Xint said.

Xint says a flaw in OpenAI’s compaction process let researchers move reasoning traces between models, potentially making it cheaper to distill a rival AI.

Xint demonstrated how OpenAI's compaction feature could expose GPT-5.6-Sol's hidden reasoning, bypassing earlier protections.

OpenAI's compaction feature, which shrinks a long conversation to save space, could be turned into a way to copy a model's hidden reasoning out in plain text, security firm Xint has shown. OpenAI's reasoning models work through a problem before answering, and the service normally returns only the raw reasoning as an encrypted item the user cannot read. The method got past

Xint said its Compaction Smuggling technique could bypass OpenAI mitigations and transfer model reasoning to another model. OpenAI confirmed the issue, fixed…

Xint says a flaw in OpenAI’s compaction process let researchers move reasoning traces between models, potentially making it cheaper to distill a rival AI.

Compaction Smuggling expone el razonamiento oculto de OpenAI con tres llamadas a su interfaz de programación. Xint divulgó la técnica el 26 de octubre: el método traslada el razonamiento interno de un modelo avanzado a otro modelo, escondido dentro de una compactación de la conversación, y deja ese contenido listo para leerse en texto claro. OpenAI confirmó el problema. La compañía aplicó una corrección no detallada el 23 de octubre y pagó una recompensa de US$6.000 al equipo de Xint, que había localizado el fallo en agosto de 2026. La técnica burló las defensas que OpenAI había instalado ese mismo agosto, tras el estudio Stolen Thoughts sobre robo de trazas de razonamiento.

Compaction Smuggling allowed for the large-scale distillation of state of the art models. | News, Vulnerability Research, AI for Security, Open Source Projects

Compaction Smuggling allowed for the large-scale distillation of state of the art models. | News, Vulnerability Research, AI for Security, Open Source Projects