The researchers said OpenAI fixed the weakness on 23 October and awarded their team a $6,000 bug bounty. Xint published its findings on 26 October, describing a technique called compaction smuggling that circumvented safeguards intended to keep models’ internal reasoning inaccessible to API users.
The flaw affected the process used to compress lengthy conversations so that AI systems can continue operating without exceeding their context limits. Xint demonstrated that instructions supplied during this process could cause protected reasoning to be reproduced in a form accessible through other models.
Xint researcher Tim Becker said the team identified the weakness in August. Its experiments focused on OpenAI’s gpt-5.6-sol model, rather than establishing that every model or customer account was vulnerable. There is no confirmed evidence that attackers exploited the technique outside the researchers’ tests.
OpenAI normally provides users with answers and, where supported, summaries of a model’s reasoning instead of the complete internal sequence of intermediate steps. That underlying material is returned through the API in encrypted form, allowing it to be reused in subsequent interactions without exposing its contents directly to the application developer.
Compaction similarly converts accumulated conversational information into an encrypted representation. The researchers found that the operation could access decrypted reasoning while accepting user-controlled instructions about how information should be preserved and formatted.
Their demonstration began with mathematics and algorithmic problems submitted to gpt-5.6-sol. They retained the encrypted reasoning generated by the model, removed the original question from the conversation history and invoked the API’s compaction function with instructions to preserve the reasoning rather than summarise it.
The researchers instructed the compaction process to place the material inside a structured JSON object and replace spaces with tab characters. Xint said that formatting change was sufficient to evade classifiers intended to prevent prohibited disclosures.
They then passed the resulting encrypted compaction item to two other OpenAI models, gpt-4.1 and gpt-4o, instructing each to reproduce its contents. Both returned readable text that the researchers identified as the protected reasoning from the original model.
The technique exploited a distinction between compaction and ordinary model interactions. Protections introduced after earlier research blocked attempts to transfer encrypted reasoning directly between different models. Compaction, however, operated through the same model that had generated the reasoning, avoiding that particular restriction before the resulting item was transferred.
Xint said the method succeeded across the reasoning-effort settings it tested. One documented experiment produced an original encrypted reasoning item containing 405 tokens, a compaction item containing 612 tokens and reproduced outputs containing 609 tokens each.
The company acknowledged an important limitation: because the original reasoning remained encrypted, it could not establish whether the recovered text matched the hidden material token for token. Matching outputs from two decoding models supported the consistency of the reproduction but did not exclude paraphrasing during compaction.
The discovery carries implications for attempts to copy proprietary AI capabilities through model distillation. Access to intermediate reasoning, including unsuccessful approaches and corrections, could provide richer training material than final answers alone. Xint identified that potential as the principal security concern, rather than claiming that customer conversations had been stolen.
OpenAI acknowledged in a September statement that malicious operators had sought to extract protected reasoning through manipulated model interactions. The company said those activities did not involve breaking encryption or directly accessing stored conversations. Its statement also recognised related vulnerabilities identified through independent security research, without establishing a connection between that campaign and Xint’s demonstration.
The vulnerability followed research published in August under the title Stolen Thoughts, which examined techniques for recovering reasoning traces from proprietary AI services. Those researchers tested systems operated by OpenAI, Anthropic and Google. Xint said the safeguards introduced after that disclosure prevented the earlier attack from succeeding during its own August experiments, before the compaction weakness was identified.
Xint described OpenAI’s October remedy as undisclosed, leaving its precise technical implementation unspecified. The change was deployed on OpenAI’s systems, with no separate patch identified for developers using the API.
The researchers have made demonstration code available publicly. Their accompanying analysis warns that server-side operations handling decrypted reasoning may require protections comparable to those governing the original encrypted material.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
