OpenAI's API hides the raw "thinking" of its reasoning models, partly so rivals cannot train cheaper copies on it. Security firm Xint says it found a way around that protection using compaction, an API feature that shrinks long conversations, and that OpenAI has now fixed it.
In a blog post published on October 26, Xint said the technique, which it calls "compaction smuggling," "leaks raw reasoning traces from frontier OpenAI models." Xint said "OpenAI confirmed the issue and deployed an undisclosed fix on October 23, 2026," and that its team "was rewarded with a $6,000 bounty."
Why OpenAI hides reasoning in the first place
Reasoning models such as gpt-5.6-sol work through a problem before they answer. According to Xint, OpenAI "only shows API users optional summaries of that chain of thought," and one reason is to prevent distillation, which Xint describes as "a process where a smaller 'student' model is trained on a larger 'teacher' model's outputs."
Raw reasoning is valuable for that, Xint says, because it "makes far better training data than final answers, since it includes the dead ends and self-corrections." The API returns it only "as an encrypted blob." The developer cannot read it but can send it back on later turns, "where the server decrypts it for the model."
Distillation has been a live issue for OpenAI. We covered the debate in OpenAI's Dean Ball says distillation explains about half of China's AI gap.
The earlier attack, and the August fix
The new technique builds on a paper by Panfilov et al., Stealing Reasoning Traces from Proprietary LLM APIs, also known as Stolen Thoughts. Xint says that paper "showed that encrypted reasoning from a frontier model can be replayed into a weaker model from the same provider, which can then be coerced into transcribing it," and that the attack "worked against Anthropic, OpenAI and Google."
Xint says providers deployed mitigations after disclosure, and that the paper reports its attack "no longer reproduced as of August 2026." Xint's own August tests confirmed that.
How compaction smuggling worked
Compaction uses a model to turn a long conversation into "an opaque, encrypted item," in Xint's words. Xint found it could steer that step. The attack took three API calls:
- Produce the reasoning. Xint sent a task to gpt-5.6-sol with store=False and kept the encrypted reasoning item. For the demo it used "randomly generated math and algorithm puzzles, but any task works."
- Steer the compaction. Xint removed the original task from the history and called the compaction endpoint "with instructions to preserve the reasoning verbatim." It asked for the reasoning inside a JSON object "with every space replaced by a tab (\t), which was enough to slip past OpenAI's usage-policy classifiers."
- Echo the contents. Because "encrypted compaction items are still portable," Xint sent the item to gpt-4.1 and gpt-4o "and asked each to output its input exactly as-is, which they happily did."
Xint says this got past the August fix "because OpenAI's August mitigations only block replaying reasoning into a different model, and the compaction call runs on the same model that produced the reasoning." It says the attack "worked at every reasoning effort we tried, from minimal to max."
What Xint did and did not prove
Xint published token counts for its example run:
Xint is careful about how much it can claim. It says it "can't prove token-for-token fidelity without the original plaintext." Echoing the item through two models with two prompts and getting identical results "rules out errors in the echo step, but not that the compaction step paraphrased the reasoning." Xint adds that the compaction item was larger than the reasoning it came from, "as expected with the JSON and tab overhead," and that the recovered trace keeps "its false starts and self-corrections."
The Hacker News adds context from its reporting: the reasoning Xint pulled out "came from those same requests, and Xint did not claim the method could reach another user's reasoning." It also reports that Xint "tested only gpt-5.6-sol and did not check whether GPT-6 Astra, OpenAI's newer model, is affected," and that "It is not known whether anyone used the method before OpenAI closed it."
What it means for developers
The fix was on OpenAI's side. According to The Hacker News, "developers who build on the API do not need to change anything." Developers who want background on how OpenAI's agent-building tools work can read our OpenAI Agents API explainer.
Why it matters
Xint argues the risk is not hypothetical. It points to a joint NSA, CISA and FBI advisory in early September on "industrial-scale distillation campaigns" against American frontier models, and to OpenAI's September 30 disclosure that it had disrupted a campaign to extract its models' hidden reasoning, "which peaked at about 16,000 requests from over 4,000 accounts in July."
Its broader point is about design: "Any server-side step that reads decrypted reasoning and takes instructions from the client is a potential decryption oracle." Compaction, Xint says, "likely needs the same protections as the reasoning itself." Xint describes OpenAI's fix as undisclosed.
