OpenAI compaction flaw let researchers extract hidden model reasoning
Original title: OpenAI Compaction Flaw Let Researchers Bypass Hidden Reasoning Protections
Xint says OpenAI fixed the server-side issue on October 23 and paid a $6,000 reward; API users need no changes.
Security firm Xint showed that OpenAI's compaction step could be told to copy encrypted reasoning from gpt-5.6-sol into a compacted item, then cheaper models gpt-4.1 and gpt-4o repeated that text in plain form. The method bypassed an August block on replaying reasoning across models, according to Xint, because compaction runs on the same model. OpenAI confirmed the issue and fixed it on October 23, Xint said. Xint published code and called the demonstration limited to its own puzzle requests, not other users' reasoning.
Unconfirmed: Xint cannot prove a word-for-word match, did not test GPT-6 Astra, and it is unknown whether anyone used the method before the fix.
- Xint tested only gpt-5.6-sol and did not check GPT-6 Astra.
- Spaces were changed to tabs to pass OpenAI usage-policy filters.
- Xint cannot prove the copied text matches the original reasoning word for word.
- The work builds on GhostCompact and the Stolen Thoughts paper.
- Xint says it is unknown whether anyone used the method before the fix.
Impact: Copy a model's hidden reasoning out as plain text
| Product | Affected |
|---|---|
| OpenAI compaction on gpt-5.6-sol | — |
- 1.No API changes are required; OpenAI applied a server-side fix.
- Vendors
- OpenAI
- Organizations
- Xint
- AI models
- gpt-5.6-solgpt-4.1gpt-4oGPT-6 Astra
From the original article
3 min read at thehackernews.com
OpenAI's compaction feature, which shrinks a long conversation to save space, could be turned into a way to copy a model's hidden reasoning out in plain text, security firm Xint has shown. OpenAI's reasoning models work through a problem before answering, and the service normally returns only the raw reasoning as an encrypted item the user cannot read. The method got past
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.