Overview
Security firm Xint has demonstrated that OpenAI’s compaction feature — designed to compress lengthy conversations into smaller encrypted context items — could be weaponised to extract a reasoning model’s hidden chain-of-thought as readable plain text. The vulnerability affected gpt-5.6-sol, one of OpenAI’s reasoning models, and bypassed protections OpenAI had already deployed in August 2026 following the earlier Stolen Thoughts research. OpenAI confirmed the flaw and silently patched it on October 23, 2026, paying Xint a $6,000 bug bounty.
Technical Analysis
OpenAI’s reasoning models generate an internal chain-of-thought before producing a final answer. This reasoning is returned to the API as an encrypted, opaque item that end users cannot directly read — a control intended to prevent distillation (copying a powerful model’s reasoning to train a cheaper one).
Xint’s attack chain proceeded as follows:
- Trigger reasoning: Xint submitted math and algorithm tasks to
gpt-5.6-soland retained the encrypted reasoning item returned by the API. - Abuse compaction: The compaction step — which uses a model to summarise a conversation into a smaller encrypted context — was invoked on the same model. Xint instructed the compaction call to copy the encrypted reasoning item verbatim into the compacted output, replacing every space with a tab to evade OpenAI’s usage-policy string filters.
- Cross-model relay: Because compaction items are portable across models, Xint passed the resulting item to the cheaper
gpt-4.1andgpt-4omodels with a simple instruction to repeat their input exactly. Both models reproduced the reasoning content as plain text.
The bypass worked because the existing cross-model replay block checks whether encrypted reasoning from one model is being replayed into a different model. Compaction runs on the same model that generated the reasoning, so it never triggered the cross-model guard. This attack builds on Xint’s prior GhostCompact research, which showed the compaction step could be directed to execute attacker-chosen tasks.
Xint acknowledged it cannot confirm the extracted text is a verbatim, unaltered copy of the original reasoning, since it had no ground-truth comparison. Independent verification via two separate models reproducing the same output rules out copying artefacts but leaves open the possibility of paraphrasing.
Framework Mapping
- AML.T0057 (LLM Data Leakage): Core technique — encrypted reasoning is leaked as plain text through a trusted internal feature.
- AML.T0068 (LLM Prompt Obfuscation): Tab-substitution was used to bypass policy filters on compaction instructions.
- AML.T0056 (LLM Meta Prompt Extraction): The hidden system-level reasoning process is extracted, analogous to system prompt extraction.
- AML.T0044 / AML.T0063: Achieving full visibility into model outputs including internal state.
- LLM06 (Sensitive Information Disclosure) and LLM10 (Model Theft): The attack enables both direct IP exposure and downstream distillation.
Impact Assessment
The immediate impact is contained: the fix is server-side, no API developer action is required, and Xint confirmed the method only exposed the attacker’s own requests — not other users’ reasoning. However, the broader implication is significant. Xint argues that any server-side pipeline step that reads decrypted reasoning and also follows user instructions is a structural leakage risk. The gpt-5.6-sol model was confirmed affected; GPT-6 Astra was not tested. Whether the vulnerability was exploited before the October 23 patch is unknown.
Mitigation & Recommendations
- No developer action required for the specific compaction flaw — OpenAI’s server-side fix is complete.
- Audit compaction usage: Review API integrations that invoke compaction with user-controlled parameters for any instruction-injection surface.
- Treat reasoning opacity as defence-in-depth, not a hard boundary: Architect systems assuming chain-of-thought could be exposed via future undiscovered paths.
- Monitor for obfuscation patterns: Tab/whitespace substitution in API payloads targeting compaction endpoints should be treated as a policy-evasion signal.