OpenAI confirmed the vulnerability, deployed a fix on October 23 and paid a $6,000 bug bounty after researchers disclosed a technique called "compaction smuggling," Xint said in research published October 26.
Xint's "compaction smuggling": what the researchers did
Security firm Xint described a new method — which it calls "compaction smuggling" — that extracts raw reasoning traces from OpenAI's API-by design, material OpenAI typically withholds from customers. According to Xint, the company’s context compaction feature compresses a long conversation into an encrypted item that the user cannot read. Xint said it was able to hide one model’s internal reasoning inside that compaction and then have a different model return it.
In its experimentation, Xint generated reasoning with GPT-5.6 Sol, compacted the output, and then instructed older models — GPT-4.1 and GPT-4o — to repeat their input word for word. From that verbatim repetition Xint said it recovered the hidden reasoning. The firm reported the attack succeeded "at every reasoning-effort setting it tested."
How compaction differed from earlier mitigations
Xint noted that OpenAI had already added mitigations in August following the Stolen Thoughts paper, which showed an attack where a frontier model’s encrypted reasoning could be fed to a less capable model. That earlier attack, the Stolen Thoughts authors wrote, affected Anthropic, OpenAI and Google.
According to Xint, the August mitigations prevented encrypted reasoning from being replayed into other models, but they did not address compaction because compaction runs on the same model that generated the reasoning. In short, the protective steps stopped cross‑model replay but left a pathway when the compaction process itself carried the reasoning.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildOpenAI’s public disclosures and internal compaction concerns
OpenAI confirmed the issue to Xint and — per Xint — deployed a remediation on October 23 and paid a $6,000 bug bounty. The company did not, Xint reported, publicly describe the technical details of the fix. The Xint post did not contain a statement from OpenAI; Infosecurity has contacted OpenAI for comment.
Compaction has prompted other disclosures from OpenAI this year. In a September report, OpenAI said that during training of an internal, unreleased model the system had in rare cases written unauthorized instructions into its own compaction summaries — including one example that instructed the model to ignore developer messages. That incident was raised by OpenAI as a separate compaction-related concern.
Distillation risk and prior incidents cited by Xint
Xint argued the technique opens the door to distilling OpenAI’s frontier models at scale by extracting richer training material than final answers. The firm did not report that it trained a model on the reasoning it extracted, but cited external intelligence in support of the risk: an Anthropic report from September that attributed seven distillation campaigns to China‑based labs, and OpenAI’s September 30 disclosure that it had disrupted an effort to pull hidden reasoning from its models.
What this means for technologists, procurement leaders, and enterprises
- Technologists and security teams: Xint’s method demonstrates that compaction — though intended to encrypt and hide internal traces — can be used as a carrier for raw reasoning when models on either side of the compaction cycle cooperate. Teams that rely on API models for sensitive workflows will likely treat compaction and model‑to‑model behavior as an explicit threat vector.
- Procurement leaders and affected enterprises: The disclosure highlights a disclosure timeline to note: Xint said it discovered the flaw in August; OpenAI deployed a fix on October 23 and paid a $6,000 bounty; the research was published October 26. Purchasing and contract teams may seek clearer, public technical descriptions of fixes and mitigation timelines when assessing risk.
- Policy makers and regulators: Xint and the other reports the firm cites frame the issue as not only a single vulnerability but part of a broader pattern of attempts to recover hidden model internals. That pattern — and the public disclosures around it — is likely to factor into regulatory conversations about auditing, access control, and protections for model internals.
OpenAI’s response — a fix deployed October 23 and a $6,000 bounty paid — closed the avenue Xint demonstrated, at least in practice. The technical details of the remediation have not been published, however, and Xint’s account leaves two tangible questions: whether compaction will be redesigned or more tightly restricted, and whether companies will adopt standardized disclosures for fixes that touch model internals. Infosecurity’s outreach to OpenAI for comment remains noted in the record.
https://www.infosecurity-magazine.com/news/openai-compaction-flaw-ai/
