VULNpocalypse
LowVulnerabilityPatch available

Xint says OpenAI API compaction flaw exposed hidden model reasoning

Xint reports an OpenAI API compaction flaw exposed raw model reasoning; per Xint, OpenAI deployed a fix, and no client action is described.

Published
Exploitation
No, only researcher use is reported; the source does not state any in-the-wild exploitation of this flaw

What happened

AI vulnerability discovery firm Xint says it found a flaw in OpenAI’s API that let it extract raw reasoning traces from OpenAI’s frontier models. OpenAI normally withholds these traces from API users. Infosecurity Magazine reports that Xint published research on the technique on October 26. Xint calls the technique “compaction smuggling”.

According to Xint, OpenAI confirmed the issue, deployed a fix on October 23 and paid a bug bounty. Infosecurity Magazine notes three gaps in the public record:

  • The Xint post did not include a statement from OpenAI.
  • OpenAI’s fix was not publicly described.
  • Infosecurity has contacted OpenAI for comment.

OpenAI’s confirmation is therefore reported only by Xint and has not been independently verified (Infosecurity Magazine).

The report describes the flaw this way (Infosecurity Magazine):

  • The feature involved. OpenAI’s context compaction feature uses a model to compress a long conversation into an encrypted item that the user cannot read.
  • The technique. Xint says it could hide one model’s reasoning inside a compaction and then have another model hand it back.
  • How Xint tested it. Xint says it generated reasoning with GPT-5.6 Sol and compacted it. It then asked the older GPT-4.1 and GPT-4o models to repeat their input word for word, and recovered the reasoning from their output.
  • Results. Xint says the attack succeeded at every reasoning-effort setting it tested.
  • Why earlier fixes missed it. OpenAI added mitigations in August after the “Stolen Thoughts” paper. According to Xint, those mitigations stopped reasoning from being replayed into other models. They did not cover compaction, which ran on the same model that had produced the reasoning.
  • Timeline. Xint discovered the flaw in August.

Xint argues that the technique opened the door to distilling OpenAI’s frontier models at scale. However, Xint did not report training a model on the reasoning it extracted (Infosecurity Magazine).

Am I affected?

According to the report, Xint’s research concerns OpenAI’s hidden model reasoning (Infosecurity Magazine). The source does not say whether any customer data, conversations or credentials were involved.

The following details are not confirmed:

  • Whether any API customer data was exposed.
  • Which API versions or endpoints were affected, beyond the compaction feature.
  • Whether anyone other than Xint used the technique.
  • An official OpenAI description of the fix.

What to do now

  1. Note that the source describes no client-side update or configuration change. According to Xint, OpenAI deployed the fix on October 23 (Infosecurity Magazine).
  2. Watch for an official statement from OpenAI. The report says OpenAI had not commented and its fix was not publicly described (Infosecurity Magazine).

Sources