OpenAI Compaction Flaw Let Researchers Extract Hidden Reasoning from gpt-5.6-sol

Security firm Xint has disclosed a vulnerability in OpenAI's API that allowed extraction of raw chain-of-thought reasoning from the gpt-5.6-sol model, bypassing protections the company deployed in August 2026. The technique, dubbed "compaction smuggling," was discovered in August, reported to OpenAI, and published on October 26. OpenAI confirmed the issue, deployed an undisclosed fix on October 23, and awarded a $6,000 bounty [1][2][3][5].

How the attack worked

OpenAI's reasoning models generate internal step-by-step traces but return only optional summaries to API users; the full reasoning is delivered as an encrypted blob (encrypted_content) that the client cannot read but can send back on later turns for the server to decrypt [5]. Compaction is a separate feature that compresses long conversations into an encrypted context item, using a model to decide what to keep [5].

Xint's three-call attack chain exploited the fact that compaction runs on the same model that produced the reasoning, so it sees the decrypted trace and can be instructed on how to format its output [5].

1. Produce reasoning: Researchers sent math and algorithm puzzles to gpt-5.6-sol with store=false and retained the returned encrypted_content [1][2][5].
2. Steer compaction: They removed the original task from the conversation history and called /responses/compact with an instructions parameter telling the model to preserve the reasoning verbatim inside a JSON object under a "solution" key, replacing every space with a tab character (\t) — a formatting change Xint says slipped past OpenAI's usage-policy classifiers [1][2][5].
3. Echo the contents: The resulting encrypted compaction item was passed to gpt-4.1 and gpt-4o, each prompted to reproduce its input exactly. Both models returned identical readable text, which the researchers decoded and converted tabs back to spaces [1][2][5].

In one demonstration, a 405-token reasoning item yielded a 612-token compaction and 609-token outputs from each decoder model [1][2][3][5].

Context: Stolen Thoughts and August mitigations

The attack builds on the "Stolen Thoughts" research (Panfilov et al., August 2026), which showed that encrypted reasoning from a frontier model could be replayed into a weaker model from the same provider and coerced into transcribing it [1][5]. OpenAI was the hardest target; the paper's authors had to use gpt-5.6-luna as a decoder, per-block prompt templates, best-of-n sampling, and chunked outputs under 50 tokens to evade safeguards [5].

Following that disclosure, providers deployed mitigations. Xint says its own August tests confirmed the original Stolen Thoughts attack no longer worked [5]. OpenAI's August controls specifically blocked direct reasoning replay across model boundaries [1][2][3]. Compaction smuggling bypassed that barrier because the compaction step executes in the originating model's context; its encrypted output remains portable to older models [1][2][3][5].

What was demonstrated — and what wasn't

Xint tested the method at every reasoning-effort setting, from minimal to maximum, and reports it worked across all of them [1][2][5]. Two different decoder models with different prompts produced identical outputs, which the researchers say rules out errors in the echo step [5].

However, Xint acknowledges a critical limitation: without access to the original plaintext reasoning, it cannot prove token-for-token fidelity. The compaction item is larger than the source reasoning (612 vs. 405 tokens), consistent with JSON and tab overhead, and the extracted trace retains false starts and self-corrections in the terse style of gpt-5.6-sol [5]. But matching outputs from two decoders do not establish that compaction preserved every original token [1][2][3][5].

The demonstration used Xint's own API requests, not another customer's conversations [1]. The firm has published its demonstration script on GitHub [2][4].

Implications: distillation risk and architectural warning

The primary risk Xint highlights is unauthorized distillation — using extracted reasoning traces to train competing "student" models. Reasoning traces are more valuable than final answers because they include dead ends and corrections [1][5]. This is not hypothetical: in early September, the NSA, CISA, and FBI issued a joint advisory on "industrial-scale distillation campaigns" against American frontier models [5]. Days later, Anthropic reported seven such campaigns by China-based labs, several targeting chain-of-thought transcripts [5]. On September 30, OpenAI disclosed it had disrupted a campaign peaking at roughly 16,000 extraction-pattern requests from over 4,000 accounts in July [3][5].

Xint's broader warning is architectural: any server-side component that reads decrypted reasoning, accepts client instructions, and produces artifacts reusable by other models functions as a decryption oracle and needs equivalent protections [1][5]. The Stolen Thoughts paper treated compaction as a legitimate feature its defenses had to work around; compaction smuggling shows it likely needs the same safeguards as the reasoning itself [5].

OpenAI's response and open questions

OpenAI confirmed the bug, fixed it on October 23 without public detail, and paid the bounty [1][2][3][5]. The company says API developers need make no code changes [4]. It is not known whether newer, unannounced models are affected; Xint tested only gpt-5.6-sol [4]. Because OpenAI has not published details of the fix, independent verification of its completeness is not yet possible.