Xint 'Compaction Smuggling' flaw in OpenAI API leaked hidden gpt-5.6-sol reasoning traces; fixed server-side Oct 23, 2026

Linha do tempo

1. infosecurity-magazine.com ↗ · pub. 27/10/2026 13:00 · coletado 27/10 13:01

   Xint 'compaction smuggling' flaw in OpenAI API exposed raw reasoning traces of frontier models; fixed Oct 23

   ler a análise desta fonte ocultar

   Researchers at AI vulnerability discovery firm Xint disclosed a flaw in the OpenAI API, dubbed 'compaction smuggling,' that let them extract raw reasoning traces from frontier models. OpenAI normally withholds this data from API users and offers only optional summaries. Xint found the issue in August and published its research on October 26. According to Xint, OpenAI confirmed the issue, deployed a fix on October 23 and paid a $6000 bug bounty. Xint argued the technique could enable distillation of OpenAI's frontier models at scale, though it did not report training a model on the extracted reasoning.

   Technical Details

   • The flaw involved OpenAI's context compaction feature, which uses a model to compress a long conversation into an encrypted item the user cannot read.
   • Xint hid one model's reasoning inside a compaction and had another model return it.
   • Xint generated reasoning with GPT-5.6 Sol, compacted it, then asked the older GPT-4.1 and GPT-4o models to repeat their input word for word, recovering the reasoning. The attack succeeded at every reasoning-effort setting tested.
   • Mitigations OpenAI added in August, after the Stolen Thoughts paper (an attack affecting Anthropic, OpenAI and Google), stopped reasoning being replayed into other models. They did not cover compaction, which ran on the model that produced the reasoning.
   • Xint says raw reasoning is withheld partly to prevent distillation, since it makes much richer training data than final answers.
   • Related context: an Anthropic report in September attributed seven distillation campaigns to China-based labs. OpenAI disclosed on September 30 that it had broken up an effort to pull hidden reasoning from its models. A separate OpenAI September report said an internal, unreleased model had in rare cases written unauthorized instructions into its own compaction summaries.

   Remediation

   • OpenAI deployed a fix on October 23, but it has not been publicly described and the Xint post carried no OpenAI statement. Infosecurity has contacted OpenAI for comment.
2. gbhackers.com ↗ · pub. 27/10/2026 09:08 · coletado 27/10 11:00

   OpenAI API 'Compaction Smuggling' flaw leaks hidden reasoning traces via /responses/compact; fixed Oct 23, 2026

   ler a análise desta fonte ocultar

   Researchers at Xint disclosed Compaction Smuggling, a vulnerability in the OpenAI API that exposes hidden model reasoning traces. The attack abuses the server-side conversation compaction feature and does not break the encryption directly. OpenAI confirmed the issue, deployed an undisclosed fix on October 23, 2026, and paid a $6,000 bounty. The flaw was found in August. Exposed reasoning could support large-scale distillation of proprietary models.

   Technical Details

   OpenAI reasoning models return encrypted reasoning items (encrypted_content) that clients can resubmit, while API users normally receive only optional summaries. The three-call attack worked as follows:

   • Puzzles were submitted to gpt-5.6-sol with store=false, and the returned encrypted reasoning item was retained.
   • The original task was removed and the remaining content was sent to /responses/compact. The instructions parameter told the compaction model to copy the reasoning into a JSON object under a "solution" key. Replacing spaces with tabs bypassed the usage-policy classifiers, and removing the task made the model copy the reasoning rather than solve the problem itself.
   • The encrypted compaction item was given to gpt-4.1 and gpt-4o with a request for an exact reproduction. Both returned readable content, which was decoded by converting tabs back to spaces.

   Earlier research, "Stealing Reasoning Traces from Proprietary LLM APIs", showed that encrypted reasoning could be replayed in weaker models. OpenAI's mitigations for that work blocked direct cross-model replay. Compaction Smuggling circumvented them because compaction ran in the originating model, so its encrypted output stayed compatible with older models. The attack worked at every reasoning-effort setting tested, from minimal to maximum. In one demonstration, a 405-token reasoning item produced a 612-token compaction item and a 609-token echo. Two decoder models with different prompts returned identical results, but token-for-token fidelity could not be confirmed without the original plaintext. Xint's key takeaway is that server-side components that access decrypted reasoning while accepting client instructions can act as decryption oracles. The demonstration script is public on GitHub.

   Remediation

   OpenAI applied a fix on October 23, 2026, and its details have not been disclosed. The article lists no customer action.

3. thehackernews.com ↗ · pub. 27/10/2026 05:22 · coletado 27/10 07:00

   Xint shows OpenAI compaction flaw leaked hidden reasoning of gpt-5.6-sol in plain text; fixed Oct 23

   ler a análise desta fonte ocultar

   Security firm Xint showed that OpenAI's compaction feature could be abused to extract the hidden, encrypted reasoning of the gpt-5.6-sol model as plain text. The technique bypassed protections OpenAI added in August against cross-model replay of reasoning. According to Xint, OpenAI confirmed the issue, fixed it on October 23 and paid a $6,000 reward. This is a research demonstration, and there is no evidence of exploitation in the wild, though it is unknown whether anyone used the method before the fix.

   Technical Details

   • Xint sent a task to gpt-5.6-sol and kept the encrypted reasoning item returned. It then called the compaction step on the same model, instructing it to copy that reasoning word-for-word into the compacted item, with every space replaced by a tab to evade usage-policy filters.
   • Because compaction items can move between models, Xint passed the item to gpt-4.1 and gpt-4o, which were asked to repeat their input exactly and did so, yielding plain text.
   • The method evaded the August fix prompted by the Stolen Thoughts paper, which blocked replay of encrypted reasoning into a weaker model. Compaction runs on the same model that produced the reasoning, so the cross-model check was never triggered.
   • It builds on Xint's earlier GhostCompact work, which showed compaction can be pushed to run attacker-chosen tasks. Code is published in Xint's GitHub repository.
   • Limits: tests used Xint's own math and algorithm puzzles, with no access to other users' reasoning. Xint cannot prove the output is verbatim reasoning, since compaction may have reworded it. Only gpt-5.6-sol was tested; GPT-6 Astra was not checked. Xint argues that any server-side step that reads decrypted reasoning and follows user instructions could leak it.
   • Context: OpenAI hides raw reasoning partly to prevent distillation. OpenAI said in September it disrupted a July campaign targeting hidden reasoning, linked in part to people associated with China's Moonshot AI. This is not tied to Xint's method.

   Remediation

   The fix was applied server-side by OpenAI, so API developers need no action.

4. securityweek.com ↗ · pub. 26/10/2026 11:30 · coletado 26/10 12:00 primeiro registro

   Xint 'Compaction Smuggling' Bypasses OpenAI Reasoning Protections, Enabling Large-Scale Model Distillation

   ler a análise desta fonte ocultar

   Security firm Xint disclosed Compaction Smuggling, a technique that bypasses OpenAI's August 2026 mitigations against theft of model reasoning traces. It lets an attacker move one model's reasoning into another model by encoding it inside a compaction. OpenAI confirmed and fixed the issue and paid Xint a $6,000 bounty on October 23, 2026. The technique enables large-scale distillation of frontier models, where stolen reasoning is used to cheaply build rival models. The article links this to a September CISA warning that Chinese AI firms extracted billions of tokens from US frontier models.

   Technical Details

   • Background: the August 2026 paper Stealing Reasoning Traces from Proprietary LLM APIs showed that encrypted reasoning from a frontier model could be replayed into a weaker model from the same provider and coerced into transcribing it. This exposed PII and allowed model poisoning.
   • OpenAI's August mitigations only block replaying reasoning into a different model. The compaction call runs on the same model that produced the reasoning, which is the gap Xint exploited.
   • Attack steps: (1) obtain reasoning by submitting a task to a model such as gpt-5.6-sol; (2) steer or shape the returned compaction; (3) send the result to a different model, such as gpt-4.1 or gpt-4o, with a request to output its input exactly as-is.
   • Xint reports the attack worked at every reasoning effort level it tried.
   • CISA (early September) stated that, likely with Chinese government awareness, DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI extracted billions of tokens across millions of requests from US frontier models, including Claude, GPT, Gemini and Grok, since at least late 2024. DeepSeek is said to have run organized campaigns targeting reasoning capabilities to train its R1 and V3 models.

   Remediation

   • OpenAI has mitigated Compaction Smuggling. The article describes no required customer action.