Security firm Xint showed that OpenAI’s compaction feature, the thing that squeezes a long conversation into a smaller encrypted item, could be abused to copy a reasoning model’s hidden chain of thought out in plain text. OpenAI confirmed it and fixed it on October 23, and paid Xint a $6,000 bounty.
How it worked
- Xint sent a task to gpt-5.6-sol and kept the encrypted reasoning it got back.
- It then called compaction on the same model and told it to copy that reasoning word for word, swapping spaces for tabs to slip past the usage filters.
- Because compaction items can move between models, Xint handed the item to gpt-4.1 and gpt-4o and asked them to repeat it. They did.
The trick dodged the cross-model replay block OpenAI added in August, because the compaction step ran on the same model that made the reasoning. Xint only pulled reasoning from its own requests, not other users’, and it can’t prove the text was word-for-word.
My take
If you build on the API, there’s nothing to change; the fix was server-side. But Xint’s bigger point stands: any server-side step that reads decrypted reasoning and follows user instructions is a possible leak. Every convenience feature you bolt onto an agent is another door. Lock them all.
God Bless, and Needs Garlic!
