OpenAI patches compaction flaw exposing protected reasoning traces

OpenAI has patched a flaw in its API that exposed sensitive reasoning from its advanced AI models, following disclosure by security researchers at Xint. The vulnerability, dubbed 'compaction smuggling', allowed protected reasoning to be extracted from the gpt-5.6-sol model, which OpenAI assigned a $6,000 bug bounty to fix. Xint published its research on October 26th, which revealed that the flaw allowed attackers to bypass safeguards meant to protect the internal reasoning of AI models.

The flaw occurred during the process of compressing lengthy conversations to prevent context limits. The researchers demonstrated that instructions provided during this process could cause protected reasoning to be reproduced in a format accessible through other models. OpenAI's normal practice is to provide summaries of a model's reasoning, not the full internal sequence of steps, which are returned in encrypted form.

Compaction, a similar process that converts conversational information into an encrypted representation, was found to bypass these protections. The researchers manipulated the encryption during compaction, allowing them to access decrypted reasoning while retaining the original format. They then passed this encrypted material to other OpenAI models, resulting in readable text that matched the original protected reasoning.

While OpenAI acknowledged the potential security concern, they noted that their protections against this technique had been in place after a previous disclosure in August. The vulnerability could have implications for AI distillation, where access to intermediate reasoning could provide better training material. OpenAI has not disclosed the exact technical implementation of their fix, but researchers have made their demonstration code publicly available.