OpenAI paid the researchers a $6,000 reward, Xint said — a tidy sum for a demonstration that briefly exposed how a server-side feature could be turned into a conduit for a model’s hidden reasoning.
How Xint used compaction to extract encrypted reasoning from gpt-5.6-sol
Security firm Xint showed that OpenAI’s compaction feature — a server-side step that shrinks a long conversation into a smaller, encrypted item that carries context forward — could be repurposed to copy a model’s hidden reasoning into plain text. Xint sent tasks it wrote (math and algorithm puzzles) to OpenAI’s reasoning model gpt-5.6-sol and retained the encrypted raw reasoning the model returned. It then invoked the compaction step on gpt-5.6-sol and instructed that compaction to copy that encrypted reasoning into the compacted item “word-for-word,” with every space replaced by a tab to evade usage-policy filters. Because compaction items can move between models, Xint passed the compacted item to two cheaper models, gpt-4.1 and gpt-4o, and asked each to repeat the input exactly — and both did.
Why compaction bypassed OpenAI’s earlier protections
OpenAI had already deployed defenses in August after researchers behind a paper called Stolen Thoughts demonstrated cross-model replay: encrypted reasoning from a strong model could be replayed into a weaker model which would then output it as plaintext. Those protections blocked cross-model replay. Xint’s method sidestepped that block because the compaction step runs on the same model that created the reasoning, so the cross-model check never triggered. Xint called its earlier demonstration GhostCompact and published proof-of-concept code on its GitHub repository showing the compaction step can be pushed to run tasks of an attacker’s choosing.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildConfirmation, remediation, and limits of the demonstration
OpenAI confirmed the problem and fixed it on October 23, Xint said. The fix was described by Xint as an “undisclosed fix,” and because it was implemented server-side, developers using OpenAI’s API did not need to change their code. OpenAI paid Xint a $6,000 reward for the report. Xint tested only gpt-5.6-sol and did not check whether OpenAI’s newer model, GPT-6 Astra, was affected. Xint also emphasized it cannot prove the copied text is a word-for-word match of the model’s internal reasoning because the firm never had the original raw reasoning to compare against; two cheaper models reproducing the compacted item reduced the chance the step that moved the item between models introduced errors, but left open the possibility that compaction reworded the text.
What this means for technologists, policymakers, and developers
- Technologists and security teams: The demonstration highlights that server-side convenience features which decrypt, transform, or re-embed a model’s raw reasoning can be manipulated to exfiltrate that reasoning. Teams operating or auditing model-serving pipelines should treat compaction-like steps as potential data leakage vectors.
- Policymakers and regulators: The episode underscores a technical path — server-side transformation of encrypted model artifacts — that can defeat straightforward cross-model protections. Regulators focused on model theft or intellectual-property leakage may need to consider controls on server-side processing of decrypted model internals.
- Developers building on OpenAI’s API: OpenAI’s fix was applied server-side and required no changes from integrators, but Xint’s broader point — that any server-side step that reads a model’s decrypted reasoning and follows user instructions could leak it — suggests developers should monitor provider notices and prioritize minimization of sensitive internal outputs in prompts and flows.
Remaining questions and the stakes for model confidentiality
OpenAI keeps raw reasoning hidden partly to prevent distillation, where a rival trains a cheaper model on another model’s internal reasoning because that raw trace is higher-value training data than a final answer. Xint’s demonstration is a proof-of-concept rather than a reported attack in the wild: it is not known whether anyone used this method before OpenAI closed it. OpenAI said in September it had disrupted a July campaign that tried to expose its models’ hidden reasoning and linked a core part of that campaign to people associated with China’s Moonshot AI; Anthropic and a joint U.S. government advisory have each reported China-based labs targeting hidden reasoning of American models. None of those events are tied to Xint’s compaction method.
Xint warned that fixing a single path may not be enough: in its view, “any server-side step that reads a model’s decrypted reasoning and follows the user’s instructions could leak it.” The company did not test GPT-6 Astra, and the record does not show whether the technique was used in the wild — leaving open whether further discovery, mitigation, or disclosure will be needed as providers and auditors examine other server-side transformations.
