OpenAI Patches Compaction Path That Exposed Model Reasoning
OpenAI has fixed a flaw in its compaction feature after security firm Xint demonstrated a way to extract hidden reasoning from gpt-5.6-sol, one of the company’s reasoning models. Xint said OpenAI confirmed the issue and deployed a server-side fix on October 23, awarding the researchers a $6,000 bug bounty.
The finding concerned encrypted reasoning generated for a user’s own prompt. Xint tested mathematics and algorithm problems written by its researchers and did not claim that the technique could retrieve another user’s reasoning. It also said it could not prove that the recovered text was a word-for-word copy of the model’s original reasoning.
How the compaction route worked
Compaction reduces a lengthy conversation into a smaller encrypted item that preserves context for later interactions. Xint first submitted a task to gpt-5.6-sol and retained the encrypted reasoning item returned by the service. It then invoked compaction on the same model and instructed it to copy that reasoning into the compacted item, changing every space to a tab to avoid usage-policy filters.
The researchers then transferred the compacted item to the less expensive gpt-4.1 and gpt-4o models and asked each model to repeat its input exactly. Both returned the same text. That consistency ruled out an error in the final copying stage, Xint said, but it did not settle whether the compaction process had altered or paraphrased the original hidden reasoning.
The route bypassed protections introduced after the August Stolen Thoughts research, which showed that encrypted reasoning from a stronger model could be replayed into a weaker model from the same provider and returned as plain text. OpenAI and other providers moved to block such cross-model replay. In Xint’s demonstration, however, compaction ran on the same model that produced the reasoning, so the cross-model check was not triggered.
What the fix means for developers
The research builds on Xint’s GhostCompact work, which argued that a compaction stage could be manipulated to perform attacker-chosen tasks. The company published code for its demonstration, while the remediation was made on OpenAI’s side. Developers using the API do not need to make a change for this specific issue.
The episode follows a related OpenAI security finding, where OpenAI bypass through chained AI interactions illustrated how model protections can be tested through chained AI interactions rather than a conventional software exploit. Here, Xint’s result depended on a server-side workflow that could access decrypted reasoning and act on user-provided instructions.
Limits of the demonstration
Xint tested only gpt-5.6-sol and did not assess whether GPT-6 Astra, OpenAI’s newer model, was affected. There is also no indication that the method was used outside the research demonstration before the fix. The company nevertheless argued that closing one route may not address the broader risk whenever a server-side process reads decrypted reasoning and follows instructions supplied by a user.
Hidden reasoning is valuable because it can provide richer material for distillation than a final answer alone, potentially helping competitors train lower-cost models. OpenAI has separately described disrupting a July campaign aimed at exposing hidden reasoning, but that activity was not linked to Xint’s compaction technique. For businesses, the practical implication is to assess AI workflows that transform protected model context as security-sensitive operations, even when the final output is intended to remain inaccessible.