Researchers at Xint discovered an OpenAI API vulnerability that exposed hidden chain-of-thought reasoning from GPT-5.6 models by routing prompts through a conversation compaction feature.
Xint calls the technique “compaction smuggling.” According to the company, the method bypassed protections OpenAI put in place in August 2026. OpenAI confirmed the issue, deployed an undisclosed fix on October 23, and awarded the research team a $6,000 bug bounty.
The case illustrates how a feature designed to preserve conversation context can become a pathway around model security controls. Xint uncovered the problem in August and published a technical report on October 26.
OpenAI’s reasoning models internally work through problems before returning final answers. While API users can receive summaries, the models’ raw reasoning traces are normally kept encrypted.
Applications can return those encrypted artifacts in later requests so OpenAI’s servers can decrypt them and restore context without exposing the raw text to clients.
Compaction serves a related purpose: it reduces long conversations into compact, encrypted items that retain useful context. Xint found that the compaction process could access decrypted reasoning while also executing instructions supplied by the API user. That combination created the vulnerability.
OpenAI API Flaw Exploit
In their demonstration, the researchers first sent math and algorithm puzzles to gpt-5.6-sol with store=false, keeping the returned encrypted_content. They then removed the original prompt and called the /responses/compact endpoint, instructing it to preserve the model’s internal reasoning rather than produce a summary. Removing the question reduced the chance the model would simply solve the puzzle again.
The team asked for a JSON object with a “solution” field, substituting tabs for spaces; Xint says that formatting change bypassed OpenAI’s usage-policy filters. They then passed the resulting encrypted compaction item to gpt-4.1 and gpt-4o, both of which reproduced the compaction’s contents as readable text.
This attack follows the “Stolen Thoughts” research, which showed that weaker models could reveal encrypted reasoning originating from stronger models. Cybersecurity News has previously reported on similar hidden-reasoning leaks across major AI APIs, after which providers introduced countermeasures.
Xint says the August controls blocked straightforward replay of reasoning into another model. Compaction sidestepped that check because it was executed on the same model that originally generated the reasoning. Once the reasoning was embedded in a compaction item, it could be moved and fed to older models. The technique worked at every level of reasoning effort the researchers tested.
Both decoder models returned identical text. Xint could not prove a bit-for-bit match with the original hidden reasoning because it did not have the plaintext for comparison. In one example the original reasoning comprised 405 tokens, compaction produced 612 tokens, and each echoed output contained 609 tokens.
The primary risk is unauthorized distillation: another model could learn from these extracted outputs. Reasoning traces are valuable training material because they reveal failed attempts and corrections as well as final answers.
Unlike a separate report about an OpenAI sandbox escape, this finding concerns access to internal reasoning rather than unauthenticated use of a model. Xint’s demonstration used its own API requests, not another customer’s conversations. Their main warning is that every server-side feature that handles decrypted reasoning needs equivalent protections, even if its stored output is encrypted.
AI is making cyberattacks faster and cheaper. Are your defenses ready to respond at machine speed?
