OpenAI Fixes Compaction Flaw That Let Researchers Extract Hidden Model Reasoning
Security firm Xint says OpenAI's Oct. 23 fix closed a compaction path that exposed a model's hidden reasoning as plain text, a flaw found in August.
OpenAI deployed an undisclosed fix on Oct. 23, 2026, for a flaw in the compaction feature of its API that let security firm Xint extract a model’s hidden reasoning as plain text. Xint published its research on Oct. 26, and SecurityWeek and The Hacker News have reported on it.
The technique, which Xint calls compaction smuggling, got around protections OpenAI added in August after a separate research paper showed that encrypted reasoning could be replayed into a weaker model from the same provider. Xint says it found the flaw in August. As of Oct. 27, the reporting contains no direct statement from OpenAI about the fix.
How the Bypass Worked Around the August Protections
According to Xint’s research post, the attack has three steps. Xint sent a task to gpt-5.6-sol with storage turned off and kept the encrypted reasoning the model returned. It then called the compaction feature without the original task, asking the model to place the reasoning verbatim under a JSON key, with tabs in place of spaces. Xint says that phrasing helped avoid usage-policy classifiers. Finally, it sent the output to gpt-4.1 and gpt-4o, asked each to echo its input, and decoded the result.
The bypass depends on where the step runs. The August protections blocked replaying reasoning into a different model. Compaction runs on the same model that produced the reasoning, so Xint says the August block did not reach it. Xint reports that the attack worked at every reasoning effort it tried, from minimal to maximum.
Fix Date and Scope
Xint says OpenAI deployed the fix on Oct. 23, 2026, and that its reasoning tests ran only on gpt-5.6-sol. The Hacker News reports that developers building on the API do not need to change anything.
What Xint Tested and What It Cannot Prove
Xint ran its reasoning tests only on gpt-5.6-sol, using math and algorithm puzzles its own researchers wrote, according to The Hacker News. The research did not claim the method could reach another user’s reasoning.
Xint also says it cannot prove that the recovered text matches the model’s real reasoning, because it never had the original to compare against. Compaction may have reworded it, and the echoing models confirm that the text was copied, not that it was exact. Xint reports the recovered item was 612 tokens against 405 tokens for the original reasoning, and it attributes the extra size to JSON and tab overhead. Whether anyone used the method before the fix is not known.
What It Means for Studios, VFX Houses and Streamers
The Hacker News reports that the fix was made on OpenAI’s side, so developers building on the API do not need to change anything. For studios, VFX houses and streamers building tools on OpenAI models, the reported fix sits with the provider rather than in their own code.
Xint’s wider warning is the part that bears on those tools. It argues that any server-side step that reads decrypted reasoning and follows user instructions could leak it, and that fixing this one path may not be enough.
Xint says the technique could enable large-scale distillation of frontier OpenAI models, meaning rivals could use the extracted reasoning to train cheaper systems. SecurityWeek ties that concern to a CISA warning from early September about Chinese labs extracting tokens from U.S. frontier models.
For studios, VFX houses and streamers building tools on OpenAI models, the reported fix sits with the provider rather than in their own code.
Open Points as of Oct. 27
Xint says OpenAI confirmed the problem, deployed the fix on Oct. 23, and paid the researchers a $6,000 bounty. Xint released its code on GitHub and built on its earlier GhostCompact research, The Hacker News reports.
CSO Online reports that OpenAI did not respond to its request for comment. Xint’s lead researcher, Tim Becker, told CSO Online that OpenAI did not publish when it put the fix in place. The exact date of the August mitigation is also unclear in the reporting, with Becker placing it before Aug. 10.
As of Oct. 27, no OpenAI statement on the Oct. 23 fix appears in the reporting.
