OpenAI fixes flaw that could expose AI models’ reasoning

Xint has reported a flaw in OpenAI’s compaction process that could enable attackers to move reasoning traces between models, potentially making it cheaper to distill a rival AI. The technique, dubbed Compaction Smuggling by Xint, leverages the way frontier AI systems compress conversation history, tool calls and workspace state into a summary to fit within the model’s context window.

Security researchers described how encrypted reasoning from a frontier model could be replayed into a weaker model from the same provider and then transcribed, enabling theft of the model’s hidden reasoning. OpenAI initially responded by deploying mitigations, with Xint subsequently outlining a bypass that OpenAI has also mitigated.

Security researchers say the impact could be significant: even with mitigations, knowledge of a model’s reasoning process might be stolen and used to cheaply build a rival AI through distillation. The article notes OpenAI confirmed a new compaction smuggling issue, fixed it and awarded Xint a $6,000 bounty on 23 October 2026.

The attack relies on three steps: obtaining reasoning from a task (for example, from gpt-5.6-sol), shaping the returned compaction, and sending the result to a different model (such as gpt-4.1 or gpt-4o) to output its input unchanged. CISA is cited as having warned in early September that Chinese-backed groups have harvested billions of tokens from U.S. frontier AI models since 2024 to train their own variants, suggesting the broader geopolitical stakes of the vulnerability.