Researchers Discover OpenAI API Vulnerability That Leaks Hidden AI Reasoning Traces

Researchers have disclosed a vulnerability in the OpenAI API that reveals hidden reasoning traces by exploiting conversation compaction.

This technique, named “Compaction Smuggling,” bypassed existing safeguards and could allow for the extraction of valuable training material from advanced models. According to Xint, OpenAI confirmed the issue, implemented an undisclosed fix on October 23, 2026, and awarded the researchers a $6,000 bounty.

Discovered in August, the vulnerability affected how encrypted reasoning interacted with compaction. This feature compresses lengthy conversations into encrypted context items. Instead of breaking encryption directly, researchers manipulated server-side processing to transfer protected reasoning into a format that older models could reproduce.

OpenAI API Vulnerability

OpenAI’s reasoning models return encrypted reasoning items that clients can submit during subsequent interactions. The server decrypts these items for model use, while API users typically receive only optional reasoning summaries. This separation is intended to protect internal reasoning from extraction and unauthorized model distillation.

The Xint researchers demonstrated a three-call attack. First, they submitted puzzles to the model gpt-5.6-sol with the parameter store set to false and retained the returned encrypted_content reasoning item.

Next, they removed the original task from the conversation and submitted the remaining content to the endpoint /responses/compact. Using the instructions parameter, they directed the compaction model to preserve the reasoning inside a JSON object under a “solution” key.

They found that replacing spaces with tabs helped bypass OpenAI’s usage-policy classifiers. By removing the task, they reduced the likelihood that the model would solve the problem independently rather than copy the existing reasoning.

Finally, researchers supplied the encrypted compaction item to versions gpt-4.1 and gpt-4o, requesting an exact reproduction. Both models returned readable content, which the researchers decoded and normalized by converting tabs back into spaces.

Earlier research titled “Stealing Reasoning Traces from Proprietary LLM APIs” demonstrated that encrypted reasoning could be replayed in weaker models and extracted as plaintext. This previous work examined architectural weaknesses across OpenAI, Anthropic, and Google.

According to Xint, OpenAI’s subsequent mitigations restricted direct reasoning replay across models. However, Compaction Smuggling circumvented that barrier because the compaction operation occurred in the originating model; its encrypted output remained compatible with older models. The attack was successful across every reasoning-effort setting tested, from minimal to maximum.

In one demonstration, a reasoning item containing 405 tokens produced a compaction item of 612 tokens and echoed outputs of 609 tokens.

Two decoder models using different prompts returned identical results, supporting the consistency of the rendering stage. However, the researchers could not confirm token-for-token fidelity without access to the original plaintext.

Xint warned that exposing reasoning could enable large-scale distillation, letting researchers train student models on proprietary problem-solving traces.

This finding highlights a significant architectural risk: server-side components that access decrypted reasoning while accepting client instructions can function as decryption oracles. The researchers have published their demonstration script in the project’s public GitHub repository.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.