Xint Finds OpenAI Compaction Flaw Exposing Hidden Reasoning

OpenAI’s compaction feature, which shortens long conversations by placing context into a compact, encrypted item, was demonstrated to leak a model’s hidden reasoning in plain text. Security firm Xint showed that the reasoning extraction could be smuggled into the compacted payload and then reproduced by other models, effectively bypassing OpenAI’s protections that guard encrypted reasoning. The researchers used gpt-5.6-sol, OpenAI’s reasoning model, and fed it math and algorithm puzzles they created themselves.

The encrypted reasoning copied into the compacted item appeared to come from those same prompts, and Xint noted that two cheaper models repeated the same text, suggesting the method could function across models, though they cannot confirm word-for-word duplication without the original to compare.

Xint asserts the attack exploited a flaw in the compaction process that ran on the same model that generated the reasoning, thereby avoiding the cross-model checks designed to prevent such leakage. The team also extended the approach to test whether GPT‑4 variants could reproduce the reasoning when fed via compaction, finding the method worked on the cheaper gpt-4.1 and gpt-4o models they tried.

OpenAI acknowledged the issue and fixed it on 23 October, and Xint described the fix as undisclosed, noting OpenAI paid a $6,000 reward. The researchers emphasise that they only demonstrated leakage from their own reasoning requests and that the broader risk remains uncertain, including whether the issue affected newer models like GPT‑6 Astra. OpenAI’s stance remains that the fix targets the specific path identified.