OpenAI Fixes Hidden Reasoning Leak, Pays $6,000

OpenAI has closed a hole that let outsiders read the hidden reasoning of its most capable models, according to the security firm Xint, which says it found the flaw in August and was paid a $6,000 bug bounty. Xint says OpenAI deployed the fix on 23 October.

The problem sat in a feature called compaction, which squeezes a long conversation into a short, encrypted summary so that an AI agent can keep working without running out of memory. Xint calls its finding “compaction smuggling” and published the details on its blog on Monday. SecurityWeek reported the research the same day.

Why that matters is distillation: training a cheaper model on the work of a better one. OpenAI shows API customers only optional summaries of what its reasoning models “think” before they answer. Xint notes that one reason is to stop distillation, because the raw reasoning, with its false starts and corrections, makes far better training data than a final answer.

In brief

Xint says a flaw in OpenAI’s compaction feature let it read the hidden reasoning of gpt-5.6-sol, data that OpenAI encrypts to deter distillation.
It got around protections OpenAI added in August by routing the reasoning through a compaction summary that older models would read back.
Xint says OpenAI fixed the flaw on 23 October and paid a $6,000 bounty. OpenAI has not commented publicly on this fix.

How the flaw worked, in outline

OpenAI does not hand that raw reasoning to customers. It returns it as an encrypted block that the customer’s software can pass back on the next turn but cannot read.

In August, a group of academic researchers showed that those encrypted blocks could be carried from a frontier model into a weaker model from the same company and coaxed out in plain text. Their paper, “Stealing Reasoning Traces from Proprietary LLM APIs”, says the trick worked against Anthropic, OpenAI and Google. Xint says OpenAI’s response was to stop reasoning being replayed into a different model, and that its own tests in August confirmed the original attack no longer worked.

Xint’s route went around that block rather than through it. Compaction runs on the same model that produced the reasoning, so the August protection did not apply to it. According to Xint, the compaction step could be steered into copying the hidden reasoning into its own encrypted summary instead of summarising the conversation. Compaction summaries, unlike reasoning blocks, could still be moved between models, because tools such as OpenAI’s Codex let users switch models after compacting. Xint says an older model, gpt-4.1 or gpt-4o in its tests, would then simply repeat the summary back in readable form. The firm says it pulled reasoning from gpt-5.6-sol this way at every reasoning setting it tried.

Xint is careful about what it proved. It says it cannot show the recovered text matches the original word for word, because it never sees the original, and that the compaction step could in principle have paraphrased. Its evidence is circumstantial but consistent: the smuggled item was larger than the reasoning it carried, and the recovered trace kept the terse style and self-corrections of a trace the academic paper decoded for the same puzzle.

The researchers found it while working on an earlier OpenAI bug, which they called GhostCompact, a billing error that made compaction almost free and that OpenAI fixed on 21 September for a $600 bounty, according to Xint. That work taught them compaction would perform almost any task asked of it, not just summarising.

Compaction was a second door to the same room

The lesson Xint draws is broad: any server-side step that can read decrypted reasoning and also takes instructions from the customer is a potential way to decrypt it. That is a design problem, not a one-off slip. The academic paper treated compaction as a legitimate feature its defences had to work around; Xint’s result says it needed the same protection as the reasoning itself, and OpenAI appears to have reached the same conclusion only after a second report.

It also fits a pattern in how these leaks are being found. OpenAI’s own 30 September account of a distillation campaign says operators tried copying encrypted reasoning between conversations and asking another model to transcribe it, and that independent researchers had separately reported “cross-model and conversation-compaction vulnerabilities”. Each fix has closed one path while leaving a neighbouring feature exposed.

A $6,000 bounty against a national-security framing

The money looks small next to the stakes officials now attach to distillation. In early September the NSA, CISA and FBI issued a joint advisory on “industrial-scale distillation campaigns” by China-based AI companies against US models. OpenAI’s 30 September post said it had disrupted a campaign that peaked at about 16,000 extraction attempts from more than 4,000 users in late July, and attributed a core cluster of it to people associated with Moonshot AI. Anthropic has described similar pressure in its own account of new defences that it says cut harvested data by 90 to 99 percent.

Xint does not say anyone used compaction smuggling in the wild, and nothing in OpenAI’s public material links the July campaign to this route. The risk it describes is cheaper, quieter extraction at scale, the kind of activity that earlier this month fed the dispute over OpenCode’s “distillation attack” breach, and that sits alongside the wider misuse of AI agents seen in cases such as Straiker’s report on attacks against banks. For companies building on reasoning models, the practical point is that encrypted does not mean sealed when the provider’s own tools can be asked to open the box.