- Xint says a context-shrinking feature in the OpenAI API could be steered to reveal hidden reasoning from a frontier model. OpenAI deployed an undisclosed fix on October 23.
- Xint argues the flaw matters because raw reasoning is useful training data, and cites government and vendor reports of organised attempts to collect it from American models.
- Leaders buying AI services should ask vendors which features read protected content and also take instructions from the customer.
The vault that obeys the teller
A bank can build a strong vault and still lose its contents. It only has to staff the counter with a teller who will read out what is inside to anyone who asks politely. The vault holds. The helper undoes it.
That is the idea behind a flaw that Xint researchers reported in the OpenAI API. The lesson is not that one safeguard failed. A feature that can read protected material, and that follows the customer's instructions, can become the way out.
What Xint found
Xint says it discovered the bug in August 2026 and calls the attack compaction smuggling. OpenAI confirmed the issue and deployed a fix on October 23, 2026. The company has not disclosed what the fix is. It paid Xint a $6,000 bounty.
Reasoning models, gpt-5.6-sol among them, work through a problem privately before replying. OpenAI gives API users only optional summaries of that work. Xint says one reason is to prevent distillation, where a smaller "student" model is trained on a larger "teacher" model's outputs. Its argument is that a rival learns more from the full working than from the polished answer, because the working shows mistakes being caught.
The API does hand back the raw reasoning, but only as an encrypted package the client cannot read. Clients can return that package in later requests, and OpenAI's servers open it for the model.
How the attack works
In August 2026, a paper called Stealing Reasoning Traces from Proprietary LLM APIs showed a way in. Sealed reasoning from a strong model can be fed to a weaker model from the same provider, and the weaker model can be pushed to write it out. Xint says the paper's attack worked against Anthropic, OpenAI and Google. The providers then deployed mitigations. Xint's own August tests confirmed the paper's attack no longer worked.
OpenAI's August mitigation blocked replaying reasoning into a different model. Xint found a gap. Compaction is a server-side step that shrinks a long conversation into an encrypted item. It runs on the model that did the thinking, so the mitigation did not catch it.
The attack took three calls. In step one, the team gave gpt-5.6-sol a puzzle and kept the sealed reasoning that came back. In step two, it removed the original task and told the compaction step, through its instructions setting, to preserve the reasoning word for word in a JSON object. Every space was replaced by a tab character. According to Xint, that formatting got past OpenAI's usage-policy filters. In step three, the team passed the compaction output to two older models, gpt-4.1 and gpt-4o, and told each to return exactly what it received. Xint says they "happily did".
Xint says the attack worked at every reasoning effort it tried, from minimal to max.
What is proven and what is not
Xint demonstrated the attack on randomly generated math and algorithm puzzles and published a demo script. The sources do not say whether anyone has exploited the technique.
Xint also states a limit. It cannot prove the output matches the original reasoning token for token, because it has no original plaintext. The paper's authors share that limit.
Its checks point one way. Two models with two different prompts returned identical results. The recovered text still contains wrong turns and corrections. Its clipped tone also resembles the trace the paper decoded for the same Codeforces problem. Those comparisons catch mistakes in the final copying step. They cannot show whether the compaction step reworded anything.
Why the incentive is real
Xint argues the technique could support distillation of frontier OpenAI models at scale, and says this is a live concern. It backs that with a run of public reports from the autumn.
Xint says the NSA, CISA and FBI jointly warned in early September about large, organised efforts to copy American frontier models by distillation. It adds that Anthropic then described seven campaigns by labs based in China, some of them targeting chain-of-thought transcripts.
Xint also says OpenAI announced on September 30 that it had stopped an attempt to pull out its models' hidden reasoning. By Xint's account, that attempt reached roughly 16,000 requests from more than 4,000 accounts at its height in July.
SecurityWeek's coverage quotes a CISA statement that lists six firms: DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI. The statement says they extracted billions of tokens from U.S. models. These are CISA's claims as quoted by SecurityWeek, and WebPulse has not verified them.
What leaders should ask
Xint's conclusion is direct. If a server-side step can read decrypted reasoning and also obeys instructions from the client, it can act as a decryption oracle: a tool that opens protected content for whoever asks. Xint argues compaction should get the same protection as the reasoning it handles.
Most organisations are customers of these APIs, not owners of the models. Three questions follow.
Ask your AI vendor which features read protected content and also accept customer instructions. Ask how those features are retested after a fix, since this bypass appeared after the first mitigations. Ask your own builders whether any internal tool summarises, translates or reformats sensitive data on request. It may be an oracle of its own.
The vault was not the problem. The helpful teller was.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Xint.
