OpenAI Compaction Flaw Exposed Hidden AI Reasoning, Researchers Say

Researchers at cybersecurity firm Xint demonstrated a flaw in OpenAI’s conversation compaction feature that could allow encrypted reasoning data to be reproduced as readable text. According to Xint, OpenAI fixed the issue on October 23, 2026, after the company reported its findings.

The research highlights potential risks in how AI systems handle sensitive internal data during conversation processing and context compression.

What Is OpenAI’s Compaction Feature?

OpenAI’s compaction feature reduces the size of long conversations by converting context into a smaller item that can be carried forward. This helps models continue working on lengthy tasks without retaining the entire conversation in its original form.

Reasoning-related data is normally protected rather than presented to users as ordinary text. However, Xint found that the compaction process could potentially be manipulated to reproduce this information in a readable format.

How Researchers Demonstrated the Flaw

Xint tested its technique against OpenAI’s gpt-5.6-sol reasoning model using custom mathematics and algorithm challenges.

According to the researchers, they retained an encrypted reasoning item produced during a task and then used the compaction process to instruct the same model to reproduce the content within a compacted item. The researchers reported changing spaces to tab characters as part of their attempt to bypass existing usage-policy filters.

They subsequently passed the resulting item to other OpenAI models, including GPT-4.1 and GPT-4o, which reproduced the text.

Xint cautioned that it could not establish whether the extracted text matched the model’s original internal reasoning word for word. The researchers did not have the original reasoning text available for direct comparison, leaving open the possibility that the compaction process had altered or paraphrased it.

Why Previous Protections Were Not Enough

The discovery followed earlier research known as Stolen Thoughts, which demonstrated a different method of exposing reasoning data by replaying encrypted items across models.

OpenAI and other AI providers subsequently introduced protections against that cross-model technique.

Xint said its compaction method worked around the earlier protection because the compaction operation ran on the same model that originally generated the reasoning data. As a result, the cross-model checks introduced to address the earlier issue did not prevent the demonstrated method.

The findings also build on Xint’s previous research, GhostCompact, which examined how OpenAI’s compaction process could be influenced to perform tasks specified by a requester.

OpenAI Fixed the Reported Issue

According to Xint, OpenAI addressed the vulnerability on October 23, 2026, and awarded the researchers $6,000 for their disclosure.

The researchers said the fix was implemented by OpenAI, meaning developers using the API did not need to make changes to their own applications in response to this specific issue.

However, Xint noted that its testing covered only gpt-5.6-sol. The research did not establish whether other models, including newer systems, were affected.

The company also said it had no evidence that the demonstrated technique had been used in real-world attacks before the fix.

Why Hidden AI Reasoning Matters

Protecting internal reasoning data is important partly because of the risk of model distillation. In this process, developers use outputs from a more capable model to train or improve a smaller, less expensive model.

Access to detailed reasoning traces could provide richer training material than final answers alone. This makes such information potentially valuable to organizations seeking to reproduce another provider’s capabilities without independently developing comparable systems.

The research also raises questions about server-side processing. Xint argued that any operation capable of accessing decrypted reasoning and following user-supplied instructions could create a potential exposure pathway if appropriate safeguards were missing.

A Wider Concern for AI Security

The report comes amid broader concerns about attempts to extract proprietary information from advanced AI systems. OpenAI has previously reported disrupting an effort to obtain hidden reasoning data, while Anthropic and US government agencies have also discussed concerns involving attempts by China-based organizations to extract capabilities from American AI models.

These separate reports should not be confused with the compaction technique demonstrated by Xint. The company described its work as a security demonstration and did not claim that its specific method had been observed in an active attack.

What Developers Should Know

For developers building applications with AI APIs, the case illustrates the importance of treating intermediate processing steps as part of the security boundary.

Although OpenAI reportedly fixed this particular issue, developers should continue to follow official API security guidance, use supported model features, keep integrations updated, and avoid assuming that encrypted or internal data is automatically safe from every possible processing flaw.

The incident also demonstrates the value of responsible vulnerability disclosure and independent security research in identifying weaknesses before they can be exploited more broadly.

Conclusion

Xint’s research demonstrated a potential way to expose readable text from protected reasoning data through OpenAI’s compaction workflow. OpenAI reportedly fixed the issue on October 23, 2026, and the researchers did not establish that the technique had been used in real-world attacks.

The findings underline a broader lesson for AI security: safeguards must cover not only model outputs but also the processing systems that handle sensitive internal data.

Source: Xint’s technical report.

CyberExy — Secure Tomorrow.