OpenAI has addressed a security vulnerability affecting its compaction feature after researchers demonstrated a technique that could bypass protections designed to keep a model’s internal reasoning hidden from users. The research, published by security firm Xint, showed that the feature responsible for compressing long conversations into a smaller encrypted context item could be manipulated to return hidden reasoning as readable text under specific conditions. According to Xint, OpenAI confirmed the issue and deployed a server side fix on October 23, 2026. The researchers emphasized that their testing was limited to reasoning generated from their own prompts and did not indicate that the technique could retrieve hidden reasoning belonging to other users. OpenAI’s reasoning models normally keep their internal thought process encrypted while presenting only the final response to users, a design intended to protect proprietary reasoning methods and reduce the possibility of misuse.
Xint conducted its research using gpt-5.6-sol, one of OpenAI’s reasoning models, by submitting mathematical and algorithm based problems created by its researchers. After receiving the encrypted reasoning output, the team invoked the compaction process on the same model and instructed it to copy the hidden reasoning into the compacted item while replacing spaces with tab characters. According to the researchers, this approach allowed the request to bypass usage policy filtering. Because compacted conversation items can be transferred between compatible models, Xint then supplied the resulting item to gpt-4.1 and gpt-4o, requesting that each repeat its input exactly. Both models returned identical text, demonstrating consistency in the extraction process. However, Xint acknowledged that it could not verify whether the recovered content represented the original reasoning word for word because the internal reasoning itself remained inaccessible for direct comparison. The findings therefore demonstrate the ability to extract reasoning content through the compaction process but do not establish that every recovered character exactly matched the model’s original internal reasoning.
The researchers stated that the technique bypassed protections OpenAI introduced in August 2026 following publication of the Stolen Thoughts research, which demonstrated that encrypted reasoning from a more capable model could previously be replayed into a less capable model from the same provider and reproduced as plain text. After that disclosure, OpenAI implemented measures to block cross model replay attacks. According to Xint, the newly identified technique differed because the compaction process operates on the same reasoning model that originally generated the encrypted content, preventing the existing cross model protection from being triggered. The research also builds on Xint’s earlier GhostCompact project, which explored how the compaction mechanism could be influenced to perform attacker selected tasks. Xint has published supporting research code through its GitHub repository. The company reported that OpenAI resolved the issue without requiring API users or developers to make configuration changes and stated that the researchers received a bug bounty reward of 6,000 US dollars for responsibly disclosing the vulnerability.
Xint limited its testing to gpt-5.6-sol and did not evaluate whether GPT-6 Astra was affected. The researchers also noted that it remains unknown whether anyone attempted to use this method before OpenAI implemented its fix. They further suggested that similar risks could exist in other server side processes that decrypt internal reasoning while simultaneously following user supplied instructions, indicating that additional safeguards may be beneficial. OpenAI has consistently stated that keeping raw reasoning hidden helps reduce the risk of model distillation, where organizations attempt to train lower cost models using outputs generated by more advanced systems. Internal reasoning provides significantly richer training material than final responses because it reveals intermediate decision making processes. The company also disclosed in September that it had disrupted a separate campaign during July that attempted to expose hidden reasoning within its models, although the source material makes clear that those previously reported activities are unrelated to the compaction technique demonstrated by Xint. As presented by the researchers, the compaction flaw represents a vulnerability disclosure that has already been addressed rather than evidence of an attack observed in active environments.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
