OpenAI compaction flaw bypassed hidden reasoning controls
An OpenAI compaction flaw allowed security firm Xint to bypass controls intended to keep a reasoning model's internal work hidden. According to Xint, OpenAI confirmed the issue and applied a server-side fix on October 23. Because the correction was made within OpenAI's service, developers using the application programming interface (API), which lets software communicate with the models, do not need to change their applications.
Reasoning models work through a task before producing an answer. OpenAI normally provides that raw reasoning only as an encrypted item, meaning its contents are encoded so the user cannot read them directly. Xint demonstrated that the compaction feature could be manipulated to reproduce the protected material as plain text. Compaction uses a model to reduce a long conversation into a smaller encrypted item while preserving the context needed for subsequent requests.
Xint tested the method against gpt-5.6-sol using mathematics and algorithm problems created by its own researchers. The extracted reasoning belonged to those test requests. The firm did not claim that the flaw could retrieve another user's reasoning, an important limit for businesses assessing whether the demonstration exposed customer conversations or crossed account boundaries.
The test began with a task submitted to gpt-5.6-sol. Xint retained the encrypted reasoning item returned by the model, then invoked compaction on the same model. Its instruction asked the model to copy the reasoning into the compacted item word for word, but to replace every space with a tab. Xint said this formatting change avoided OpenAI's usage-policy filters.
Compaction items can be transferred between models. Xint therefore supplied the resulting item to the less expensive gpt-4.1 and gpt-4o models, asking both to repeat their input exactly. Each produced the same text. Xint said that agreement ruled out an error during the copying stage, but it did not establish that the result matched the original reasoning word for word. Because the researchers could not view the protected original, they could not exclude the possibility that compaction had rephrased it.
The method worked around safeguards introduced after earlier research called Stolen Thoughts. That work showed that encrypted reasoning generated by a stronger model could be replayed into a weaker model from the same provider, which could then return it in readable form. OpenAI and other providers blocked that kind of cross-model replay in August. Xint said compaction avoided the new check because the same model that generated the reasoning also processed it during compaction. The protected material crossed to the cheaper models only after that step.
Xint developed the technique from earlier work it calls GhostCompact, which showed that compaction could be induced to perform tasks selected by an attacker. The firm has published code for that earlier work in a GitHub repository. Xint described OpenAI's October 23 correction as an undisclosed fix and said it received a $6,000 reward for reporting the problem.
Several boundaries remain. Xint tested only gpt-5.6-sol and did not determine whether the newer GPT-6 Astra model was affected. It is also unknown whether anyone used this technique before the flaw was closed. The work was a controlled demonstration, not an attack reported in the wild. Xint further argued that addressing this particular route may not resolve the wider design risk: any server-side process that can read decrypted reasoning while also obeying user instructions could potentially disclose that material.
Hidden reasoning matters because it can be useful for distillation, the practice of training a less expensive model using another model's outputs. A final answer supplies only the result, while raw reasoning also shows the intermediate process used to reach it. That makes the protected material more valuable as training data and explains why model providers place controls around access to it.
For website owners and IT teams, the immediate impact is concentrated on applications that integrate these AI models rather than on ordinary website software. The fix requires no developer action, but teams should still know whether their applications use compaction, which models they call and who can access the associated API credentials. For organisations that place AI APIs inside business systems, AEU-I offers security-first IT, infrastructure and consulting.
The case also illustrates why encrypted model output should not automatically be treated as permanently unreadable when another service-side feature can process it. OpenAI has closed the demonstrated path, but Xint's test does not establish whether other models or similar server-side workflows are affected.